title: (Attempting to) migrate from WSE 3.0 to WCF for client code
body: <p>I have been all over the net for this. I've just been having a devil of a time doing it, and the vendor whose web service I'm trying to consume refuses to officially support WCF as a method of consumption.</p>
  
  <p>I'm no web services expert, so I'll do my best to document and explain with this initial post, but by all means, request more information if you need it, and hopefully I'll be able to supply whatever is necessary.</p>
  
  <p><strong>The service</strong></p>
  
  <p>At my company, we use a vendor application that exposes a service. The application is written in java, and it looks like the wsdl was created with Apache Axis 1.2.</p>
  
  <p><strong>The code</strong></p>
  
  <p>My legacy code uses WSE 3.0. In particular, it uses the proxy classes that have "WSE" auto-tacked at the end. This allows me to use a much simpler authentication scheme (the only way I could get it to work). I don't need to use certificates. I use a derivative of <code>SecurityPolicyAssertion</code>, and wrap it in a <code>Policy</code> object that gets passed to the <code>SetPolicy</code> method of the client class. Here's all I need to do to create a working instance of the client:</p>
  
  <pre><code>MyWebServiceWse api = new MyWebServiceWse();
  api.Url = myUrl;
  api.SetPolicy(new Policy(new MyDerivedSecurityAssertion(user, pass)));
  </code></pre>
  
  <p>My default, out-of-the-box code for WCF (generated with a service reference) does not accept credentials, so I know there's a problem right off the bat. I've read various things online about using different <code>security</code> or binding settings in my <code>app.config</code>, but nothing has ever completely worked. My most common error after copious tinkering is <code>WSDoAllReceiver: Request does not contain required Security header</code>.</p>
  
  <p>Here's the app.config. Perhaps we could start by telling me what ought to change here to facilitate passing the credentials--again, I've seen varying opinions online.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
      &lt;system.serviceModel&gt;
          &lt;bindings&gt;
              &lt;basicHttpBinding&gt;
                  &lt;binding name="MySoapBinding" closeTimeout="00:01:00"
                      openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                      allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                      messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                      useDefaultWebProxy="true"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                      &lt;security mode="None"&gt;
                          &lt;transport clientCredentialType="None" proxyCredentialType="None"
                              realm="" /&gt;
                          &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
              &lt;/basicHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;client&gt;
              &lt;endpoint address="http://xyz:12345/services/MyService"
                  binding="basicHttpBinding" bindingConfiguration="MySoapBinding"
                  contract="MyNS.MyService" name="MyService" /&gt;
          &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I have changed some of the attributes to obscure the specific service we are using (company policy and all that).</p>
  
  <p>And here is the sample C# code so far (testing in a console app):</p>
  
  <pre><code>MyClient client = new MyClient();
  client.listMethod();
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Read this SO post: <a href="https://stackoverflow.com/questions/806007/connect-with-wcf-to-a-webservice-authenticated-with-username-password">wcf security . . .</a>.</p>
  
  <p>I have updated my app.config accordingly, and am now passing username and pwd in code. I am still receiving the same error:</p>
  
  <pre><code>WSDoAllReceiver: Request does not contain required Security header
  </code></pre>
  
  <p><strong>20120517 UPDATE</strong></p>
  
  <p>A successful request (from WSE3):</p>
  
  <p>
  </p>
  
  <pre><code>  &lt;soap:Header&gt;
      &lt;wsa:Action&gt;
      &lt;/wsa:Action&gt;
      &lt;wsa:MessageID&gt;urn:uuid:cb739422-c077-4eec-8cb2-686837b76878&lt;/wsa:MessageID&gt;
      &lt;wsa:ReplyTo&gt;
        &lt;wsa:Address&gt;http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/wsa:Address&gt;
      &lt;/wsa:ReplyTo&gt;
      &lt;wsa:To&gt;http://removed-for-security&lt;/wsa:To&gt;
      &lt;wsse:Security soap:mustUnderstand="1"&gt;
        &lt;wsu:Timestamp wsu:Id="Timestamp-e13feaf9-33d9-47bf-ab5b-60b4611eb81a"&gt;
          &lt;wsu:Created&gt;2012-05-17T11:25:41Z&lt;/wsu:Created&gt;
          &lt;wsu:Expires&gt;2012-05-17T11:30:41Z&lt;/wsu:Expires&gt;
        &lt;/wsu:Timestamp&gt;
        &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-00c26e1a-3b3b-400f-a99a-3aa54cf8c8ff"&gt;
          &lt;wsse:Username&gt;change-to-protect-the-innocent&lt;/wsse:Username&gt;
          &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;nice-try&lt;/wsse:Password&gt;
          &lt;wsse:Nonce&gt;KJMvUuWF2eO2uIJCuxJC4A==&lt;/wsse:Nonce&gt;
          &lt;wsu:Created&gt;2012-05-17T11:25:41Z&lt;/wsu:Created&gt;
        &lt;/wsse:UsernameToken&gt;
      &lt;/wsse:Security&gt;
    &lt;/soap:Header&gt;
    &lt;soap:Body&gt;
      &lt;listChannels xmlns="http://removed-for-security"&gt;
        &lt;rowfrom&gt;0&lt;/rowfrom&gt;
        &lt;rowto&gt;10&lt;/rowto&gt;
      &lt;/listChannels&gt;
    &lt;/soap:Body&gt;
  &lt;/soap:Envelope&gt;
  </code></pre>
  
  <p>Working on getting the WCF trace--will add shortly.</p>
  
  <p><strong>20120517 UPDATE 2</strong></p>
  
  <p>And here's the envelope from WCF:</p>
  
  <pre><code>  &lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"&gt;
      &lt;s:Header&gt;
        &lt;Action s:mustUnderstand="1" xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none"&gt;&lt;/Action&gt;
      &lt;/s:Header&gt;
      &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
        &lt;listChannels xmlns="http://removed-for-security"&gt;
          &lt;rowfrom&gt;1&lt;/rowfrom&gt;
          &lt;rowto&gt;2147483647&lt;/rowto&gt;
        &lt;/listChannels&gt;
      &lt;/s:Body&gt;
    &lt;/s:Envelope&gt;
  </code></pre>
  
  <p><strong>20120518 UPDATE</strong>
  I have tried implementing the solution in the post that Mike Miller links to in the comments. Now I receive the following error (no message ends up getting sent because something's barfing on the scheme):</p>
  
  <pre><code>The provided URI scheme 'http' is invalid; expected 'https'.
  </code></pre>
  
  <p>And in case anyone wants to ask, yes, I need to send over http, and yes, I'm aware that credentials are sent as unencrypted strings :-)</p>