title: Correct way communicate WSSE Usernametoken for SOAP webservice
body: <p>I am attempting to consume a web service through its corresponding wsdl. This service is dependent upon authentication conforming to <a href="http://www.ws-i.org/profiles/basicsecurityprofile-1.0.html#UsernameToken" rel="noreferrer">Web Services Security Basic Security Profile 1.0</a> including that the correct xmls namespace of <a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401wss-wssecurity-secext-1.0.xsd" rel="noreferrer">http://docs.oasis-open.org/wss/2004/01/oasis-200401wss-wssecurity-secext-1.0.xsd</a> must be included in the request.</p>
  
  <p>Example:</p>
  
  <pre><code>&lt;wsse:UsernameToken xmlns:wsse='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' &gt;
     &lt;wsse:Username&gt;
        Bob
     &lt;/wsse:Username&gt;
     &lt;wsse:Password Type='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText'&gt;
        1234
     &lt;/wsse:Password&gt;
  &lt;/wsse:UsernameToken&gt;
  </code></pre>
  
  <p>My first attempts were along the lines of <code>Add Service Reference</code> targeting the wsdl and from the generated proxies using them as such</p>
  
  <pre><code>ServicePointManager.ServerCertificateValidationCallback = 
      (object s, X509Certificate certificate, X509Chain chain,
                       SslPolicyErrors sslPolicyErrors) =&gt; true;
  
  var basicHttpBinding = new BasicHttpBinding(BasicHttpSecurityMode.Transport);
  basicHttpBinding.Security.Transport.ClientCredentialType = 
                                                  HttpClientCredentialType.Basic;
  
  var endpoint = new EndpointAddress("https://secure-ausomxana.crmondemand.com/..."
  
  using (var client = new ContactClient(basicHttpBinding, endpoint))
  {
  
      var credential = client.ClientCredentials.UserName;
      credential.UserName = "bob";
      credential.Password = "1234";
  
      var input = ...    
      var output = client.ContactQueryPage(input);
  }
  </code></pre>
  
  <p>However attempting to interrogate the SOAP messages with Fiddler I see that no UsernameToken element has been added.</p>
  
  <p>What is the correct way to fulfill this contract?</p>
  
  <p><strong>Edit:</strong> following the response from @John Saunders  I attempted to alter my code to use a wsHttpBinding</p>
  
  <pre><code>var wsHttpBinding = new WSHttpBinding(SecurityMode.Transport);
  wsHttpBinding.Security.Transport.ClientCredentialType =
                                           HttpClientCredentialType.Basic;
  </code></pre>
  
  <p>Using this binding the SOAP message becomes </p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"&gt;
    &lt;s:Header&gt;
      &lt;a:Action s:mustUnderstand="1"&gt;document/urn:crmondemand/ws/ecbs/contact/10/2004:ContactQueryPage&lt;/a:Action&gt;
      &lt;a:MessageID&gt;urn:uuid:17807f44-1fcasfdsfd&lt;/a:MessageID&gt;
      &lt;a:ReplyTo&gt;
        &lt;a:Address&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
      &lt;/a:ReplyTo&gt;
      &lt;a:To s:mustUnderstand="1"&gt;https://secure-ausomxana.crmondemand.com/Services/Integration&lt;/a:To&gt;
    &lt;/s:Header&gt;
    &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;ContactQueryPage_Input xmlns="urn:crmondemand/ws/ecbs/contact/10/2004"&gt;
        &lt;ListOfContact xmlns="urn:/crmondemand/xml/Contact/Query"&gt;
          &lt;Contact&gt;
            &lt;Id&gt;1-asdfd&lt;/Id&gt;
          &lt;/Contact&gt;
        &lt;/ListOfContact&gt;
      &lt;/ContactQueryPage_Input&gt;
    &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>This adds the Header element, as opposed to the <code>wsse:UsernameToken</code> element for reference the original soap message using the BasicHttpBinding is</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"&gt;
    &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;ContactQueryPage_Input xmlns="urn:crmondemand/ws/ecbs/contact/10/2004"&gt;
        &lt;ListOfContact xmlns="urn:/crmondemand/xml/Contact/Query"&gt;
          &lt;Contact&gt;
            &lt;Id&gt;1-asdfds&lt;/Id&gt;
          &lt;/Contact&gt;
        &lt;/ListOfContact&gt;
      &lt;/ContactQueryPage_Input&gt;
    &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>If I change the binding to be </p>
  
  <pre><code>var wsHttpBinding = new WSHttpBinding(SecurityMode.TransportWithMessageCredential);
  wsHttpBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Basic;
  wsHttpBinding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
  </code></pre>
  
  <p>The SOAP message I get out is</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
    &lt;s:Header&gt;
      &lt;a:Action s:mustUnderstand="1"&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT&lt;/a:Action&gt;
      &lt;a:MessageID&gt;urn:uuid:eeb75457-f29e-4c65-b4bf-b580da26e0c5&lt;/a:MessageID&gt;
      &lt;a:ReplyTo&gt;
        &lt;a:Address&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
      &lt;/a:ReplyTo&gt;
      &lt;a:To s:mustUnderstand="1"&gt;https://secure-ausomxana.crmondemand.com/Services/Integration&lt;/a:To&gt;
      &lt;o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1"&gt;
        &lt;u:Timestamp u:Id="_0"&gt;
          &lt;u:Created&gt;2011-05-02T13:30:09.360Z&lt;/u:Created&gt;
          &lt;u:Expires&gt;2011-05-02T13:35:09.360Z&lt;/u:Expires&gt;
        &lt;/u:Timestamp&gt;
        &lt;o:UsernameToken u:Id="uuid-dc3605a0-6878-42f4-b1f2-37d5c04ed7b4-2"&gt;
          &lt;o:Username&gt;Bob&lt;/o:Username&gt;
          &lt;o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;1234&lt;/o:Password&gt;
        &lt;/o:UsernameToken&gt;
      &lt;/o:Security&gt;
    &lt;/s:Header&gt;
    &lt;s:Body&gt;
      &lt;t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"&gt;
        &lt;t:TokenType&gt;http://schemas.xmlsoap.org/ws/2005/02/sc/sct&lt;/t:TokenType&gt;
        &lt;t:RequestType&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/Issue&lt;/t:RequestType&gt;
        &lt;t:Entropy&gt;
          &lt;t:BinarySecret u:Id="uuid-7195ad74-580b-4e52-9e2c-682e5a684345-1" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce"&gt;bI4xuyKwZ8OkQYBRnz2LDNV+zhIOnl0nwP24yI1QAwA=&lt;/t:BinarySecret&gt;
        &lt;/t:Entropy&gt;
        &lt;t:KeySize&gt;256&lt;/t:KeySize&gt;
      &lt;/t:RequestSecurityToken&gt;
    &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>This seems to be very close however this appears to have actually encrypted the body of the soap message which is something I do NOT want to happen.</p>
  
  <p>If I specify <code>wsHttpBinding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;</code> with only using <code>SecurityMode.Transport</code> it goes back to where it says its anonymous. </p>
  
  <p>What is the final hurdle I'm not able to clear on this?</p>
  
  <p><strong>Final Solution:</strong> Figured I'd post this incase it helps someone, there's not really much different here other the UserToken object is wrapped in a Security node which is what my service provider required and seems to be how its output from my previous examples from what I could get generated.</p>
  
  <pre><code>&lt;system.serviceModel&gt;
    &lt;bindings&gt;    
      &lt;basicHttpBinding&gt;
        &lt;binding name="Contact" closeTimeout="00:01:00" openTimeout="00:01:00"
            receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
            bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
            maxBufferSize="524288" maxBufferPoolSize="524288" maxReceivedMessageSize="524288"
            messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
            useDefaultWebProxy="true"&gt;
          &lt;readerQuotas maxDepth="32" maxStringContentLength="65536" maxArrayLength="131072"
              maxBytesPerRead="32768" maxNameTableCharCount="131072" /&gt;
          &lt;security mode="Transport"&gt;
            &lt;transport clientCredentialType="None" proxyCredentialType="None"
                realm="" /&gt;
            &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;         
      &lt;/basicHttpBinding&gt;
    &lt;/bindings&gt;
    &lt;client&gt;
      &lt;endpoint address="https://secure-ausomxana.crmondemand.com/Services/Integration"
         binding="basicHttpBinding" bindingConfiguration="Contact"
         contract="OnDemandContactService.Contact" name="OnDemand.Contact.Endpoint"&gt;
        &lt;headers&gt;        
          &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
            &lt;wsse:UsernameToken&gt;
              &lt;wsse:Username&gt;USERNAME&lt;/wsse:Username&gt;
              &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;PASSWORD&lt;/wsse:Password&gt;
            &lt;/wsse:UsernameToken&gt;
          &lt;/wsse:Security&gt;
        &lt;/headers&gt;
      &lt;/endpoint&gt;
    &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>See <a href="https://stackoverflow.com/questions/14327960/with-c-wcf-soap-consumer-that-uses-wsse-plain-text-authentication/14334760">With C#, WCF SOAP consumer that uses WSSE plain text authentication?</a> for how to configure it using code and not config</p>