title: Configure WCF for WS-Security with Username over https
body: <p>I'm trying to call a Java based, WS-Security enabled web service over https using a WCF client and can't seem to get the security configuration right.  Using SvcTraceViewer, I don't see the expected security header with any of the security configurations I have tried.</p>
  
  <p>My most recent security configuration is:</p>
  
  <pre><code>    &lt;wsHttpBinding&gt;
          &lt;binding name="MySoapBinding" closeTimeout="00:01:00"
              openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
              allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
              maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
              messageEncoding="Text" textEncoding="utf-8"
              useDefaultWebProxy="true"&gt;
              &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                  maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;transport/&gt;
              &lt;message clientCredentialType="UserName" negotiateServiceCredential="false" establishSecurityContext="false"/&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
      &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>and I set the username/password in code like this:</p>
  
  <pre><code>    svc.ClientCredentials.UserName.UserName = TestBase.userName;
      svc.ClientCredentials.UserName.Password = TestBase.password;
  </code></pre>
  
  <p>The Java web service expects a security header like this:</p>
  
  <pre><code>&lt;wsse:Security soap:mustUnderstand="1"&gt;
  &lt;wsu:Timestamp wsu:Id="Timestamp-bf41c571-7d32-438c-937e-7d83a3ac2d14"&gt;
  &lt;wsu:Created&gt;2010-12-27T16:43:16Z&lt;/wsu:Created&gt;
  &lt;wsu:Expires&gt;2010-12-27T16:48:16Z&lt;/wsu:Expires&gt;
  &lt;/wsu:Timestamp&gt;
  &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-4c9b30b1-d697-4c64-89cb-a6d7e857aebf"&gt;
  &lt;wsse:Username&gt;MyUserName&lt;/wsse:Username&gt;
  &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;MyPassword&lt;/wsse:Password&gt;
  &lt;wsse:Nonce&gt;pzLdD4S+OCDG6Ut9Ur1oOQ==&lt;/wsse:Nonce&gt;
  &lt;wsu:Created&gt;2010-12-27T16:43:16Z&lt;/wsu:Created&gt;
  &lt;/wsse:UsernameToken&gt;
  &lt;/wsse:Security&gt;
  </code></pre>
  
  <p>I see no Security header at all.</p>
  
  <p>I have read quite a bit online about transport vs. message level security and security modes, but can't seem to find the right set of options.  How should I configure my binding for</p>
  
  <ul>
  <li>https communication</li>
  <li>Username/passowrd in the SOAP header, in plain text (WS-Security)</li>
  <li>Timestamp required</li>
  <li>Nonce required</li>
  </ul>