title: How to make WCF Client conform to specific WS-Security
body: <p>I must make my WCF Client consume a web service (IBM DataPower) and sign/encrypt the request using <a href="http://www.google.co.uk/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=1&amp;ved=0CF0QFjAA&amp;url=http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec-os-x509TokenProfile.pdf&amp;ei=MovHT52BFKmb1AX_iv2mDw&amp;usg=AFQjCNHWlNOyaK1zZC6zjNrwIbx63tbKUw&amp;sig2=6PdyBqN2MAF6y3DjSR_rug" rel="nofollow">Web Services Security X.509 Certificate Token Profile 1.1 OASIS Standard Specification, 1 February 2006</a>.</p>
  
  <p>So far I have created a custom binding and "think" I am working along the right lines:</p>
  
  <p><strong>Updated to reflect latest attempt</strong></p>
  
  <pre><code>Private Function CreateCustomBinding() As Channels.Binding
  
      Dim asbe As New Channels.AsymmetricSecurityBindingElement
  
      asbe.MessageSecurityVersion = MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10
  
      asbe.InitiatorTokenParameters = New ServiceModel.Security.Tokens.X509SecurityTokenParameters
      asbe.RecipientTokenParameters = New ServiceModel.Security.Tokens.X509SecurityTokenParameters
  
      asbe.MessageProtectionOrder = Security.MessageProtectionOrder.EncryptBeforeSign
  
      asbe.SecurityHeaderLayout = SecurityHeaderLayout.Strict
  
      asbe.IncludeTimestamp = True
      asbe.SetKeyDerivation(False)
  
      asbe.DefaultAlgorithmSuite = Security.SecurityAlgorithmSuite.Basic128Rsa15  'By default, AES-128 is used as the encryption algorithm.
  
      'Add the elements to the custom binding
      Dim myBinding As New CustomBinding
  
      'element order is important - see http://msdn.microsoft.com/en-us/library/ms733893(v=vs.90).aspx
  
      'Protocol Binding Elements (security)
      myBinding.Elements.Add(asbe)
  
      'Encoding Binding Element  
      myBinding.Elements.Add(New TextMessageEncodingBindingElement(MessageVersion.Soap11WSAddressing10, System.Text.Encoding.UTF8))
  
      'Transport Binding Element
      Dim httpsBindingElement As New HttpsTransportBindingElement()
      httpsBindingElement.RequireClientCertificate = True
      myBinding.Elements.Add(httpsBindingElement)
  
      Return myBinding
  
  End Function
  </code></pre>
  
  <p>Then use this binding like so:</p>
  
  <pre><code>Dim epi As EndpointIdentity = EndpointIdentity.CreateDnsIdentity("xgtwsqa.theirdomain.com")
  
  Dim epuri As Uri = New Uri("https://xgtwqa.theirdomain.com/5067/ProcessRepairOrder")
  Dim ea As New EndpointAddress(epuri, epi, New AddressHeaderCollection)
  
  Dim myBinding As Binding = GetCustomBinding2()
  
  ' Create the client. 
  Dim starClientProxy As New wcfStarServiceProxy.starTransportPortTypesClient(myBinding, ea)
  
  ' Specify a certificate to use for authenticating the client.
  starClientProxy.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindBySubjectName, "*.mydomain.org.uk")
  
  starClientProxy.ClientCredentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.CurrentUser, StoreName.AddressBook, X509FindType.FindBySubjectName, "xgtwsqa.theirdomain.com")
  
  'starClientProxy.ClientCredentials.ServiceCertificate.SetScopedCertificate(StoreLocation.CurrentUser, StoreName.AddressBook, X509FindType.FindBySubjectName, "xgtwsqa.theirdomain.com", New Uri("https://xgtwqa.thedomain.com/5067/ProcessRepairOrder"))
  
  ' Begin using the client.
  Dim response As wcfStarServiceProxy.AcknowledgeRepairOrderPayload = starClientProxy.ProcessMessage(payload)
  </code></pre>
  
  <p><strong>Would someone either tell me what else I need to configure in the binding (I am pretty sure the binding method isn't quite right) or provide me with the code I need?</strong></p>
  
  <p>The above produces the following SOAP:</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:a="http://www.w3.org/2005/08/addressing"
  xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  
    &lt;s:Header&gt;
      &lt;a:Action s:mustUnderstand="1" u:Id="_3"&gt;
      http://www.starstandards.org/webservices/2009/transport/operations/ProcessMessage&lt;/a:Action&gt;
      &lt;a:MessageID u:Id="_4"&gt;
      urn:uuid:c2acbb72-49c2-465b-b177-e806494cdef7&lt;/a:MessageID&gt;
      &lt;a:ReplyTo u:Id="_5"&gt;
        &lt;a:Address&gt;
        http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
      &lt;/a:ReplyTo&gt;
      &lt;a:To s:mustUnderstand="1" u:Id="_6"&gt;
      https://xgtwqa.theirdomain.com/5067/ProcessRepairOrder&lt;/a:To&gt;
      &lt;o:Security s:mustUnderstand="1"
      xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
  
        &lt;u:Timestamp u:Id="uuid-b8d302ff-a098-42bb-afc6-694e647c23b0-1"&gt;
  
          &lt;u:Created&gt;2012-06-01T14:35:18.781Z&lt;/u:Created&gt;
          &lt;u:Expires&gt;2012-06-01T14:40:18.781Z&lt;/u:Expires&gt;
        &lt;/u:Timestamp&gt;
        &lt;o:BinarySecurityToken u:Id="uuid-7f9c9673-ae43-4fb5-8510-03cc4b98fa93-2"
        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;
        removed&lt;/o:BinarySecurityToken&gt;
        &lt;o:BinarySecurityToken u:Id="uuid-7f9c9673-ae43-4fb5-8510-03cc4b98fa93-1"
        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;
        removed&lt;/o:BinarySecurityToken&gt;
        &lt;e:EncryptedKey Id="_0"
        xmlns:e="http://www.w3.org/2001/04/xmlenc#"&gt;
          &lt;e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" /&gt;
          &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
            &lt;o:SecurityTokenReference&gt;
              &lt;o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
              URI="#uuid-7f9c9673-ae43-4fb5-8510-03cc4b98fa93-1" /&gt;
            &lt;/o:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
          &lt;e:CipherData&gt;
            &lt;e:CipherValue&gt;
            removed&lt;/e:CipherValue&gt;
          &lt;/e:CipherData&gt;
        &lt;/e:EncryptedKey&gt;
        &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;SignedInfo&gt;
            &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
            &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
            &lt;Reference URI="#_2"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removed&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#_3"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removed&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#_4"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removed&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#_5"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removed&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#_6"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removed&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#uuid-b8d302ff-a098-42bb-afc6-694e647c23b0-1"&gt;
  
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removed&lt;/DigestValue&gt;
            &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
          &lt;SignatureValue&gt;
          removed&lt;/SignatureValue&gt;
          &lt;KeyInfo&gt;
            &lt;o:SecurityTokenReference&gt;
              &lt;o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
              URI="#uuid-7f9c9673-ae43-4fb5-8510-03cc4b98fa93-2" /&gt;
            &lt;/o:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
        &lt;/Signature&gt;
        &lt;e:ReferenceList xmlns:e="http://www.w3.org/2001/04/xmlenc#"&gt;
          &lt;e:DataReference URI="#_1" /&gt;
        &lt;/e:ReferenceList&gt;
      &lt;/o:Security&gt;
    &lt;/s:Header&gt;
    &lt;s:Body u:Id="_2"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;e:EncryptedData Id="_1"
      Type="http://www.w3.org/2001/04/xmlenc#Content"
      xmlns:e="http://www.w3.org/2001/04/xmlenc#"&gt;
        &lt;e:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"&gt;
        &lt;/e:EncryptionMethod&gt;
        &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;o:SecurityTokenReference xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
            &lt;o:Reference URI="#_0"&gt;&lt;/o:Reference&gt;
          &lt;/o:SecurityTokenReference&gt;
        &lt;/KeyInfo&gt;
        &lt;e:CipherData&gt;
          &lt;e:CipherValue&gt;removed&lt;/e:CipherValue&gt;
        &lt;/e:CipherData&gt;
      &lt;/e:EncryptedData&gt;
    &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>This is a sample of the SOAP I am expected to send:</p>
  
  <pre><code>&lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:wsa="http://www.w3.org/2005/08/addressing"
  xmlns:star="http://www.starstandard.org/STAR/5"
  xmlns:tran="http://www.starstandards.org/webservices/2005/10/transport"&gt;
  
    &lt;soap:Header&gt;
      &lt;wsa:To&gt;urn:removed/star/services/v1/GetConditionCodes&lt;/wsa:To&gt;
      &lt;wsa:Action&gt;
      http://www.starstandards.org/webservices/2005/10/transport/operations/ProcessMessage&lt;/wsa:Action&gt;
      &lt;wsa:MessageID&gt;
      ef67ec85-d5c7-4669-b1a6-440ec2fe938b&lt;/wsa:MessageID&gt;
  
      &lt;tns:RespondTo xmlns:tns="urn:removed/soa/routing/v1.0"&gt;
        &lt;tns:Endpoint&gt;
        https://b2b-test.mydomain.com/Async/removed/StarWebService.ashx&lt;/tns:Endpoint&gt;
      &lt;/tns:RespondTo&gt;
      &lt;tran:payloadManifest&gt;
        &lt;tran:manifest contentID="A0"
        namespaceURI="http://www.starstandard.org/STAR/5"
        element="GetStandardCodes" version="5.2.4" /&gt;
      &lt;/tran:payloadManifest&gt;
      &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
      mustUnderstand="1"&gt;
        &lt;u:Timestamp xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
        Id="timestamp" u:Id="timestamp"&gt;
          &lt;u:Created&gt;2012-05-30T16:39:39Z&lt;/u:Created&gt;
          &lt;u:Expires&gt;2012-05-30T16:44:39Z&lt;/u:Expires&gt;
        &lt;/u:Timestamp&gt;
        &lt;wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
        wsu:Id="binary_security_token"&gt;
        removed&lt;/wsse:BinarySecurityToken&gt;
        &lt;EncryptedKey xmlns="http://www.w3.org/2001/04/xmlenc#"&gt;
          &lt;EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" /&gt;
          &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
            &lt;wsse:SecurityTokenReference&gt;
              &lt;wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier"
              EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;
              4qEuhS3IWjReFLSSCOcVoN6Ywzo=&lt;/wsse:KeyIdentifier&gt;
            &lt;/wsse:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
          &lt;CipherData&gt;
            &lt;CipherValue&gt;
            removed&lt;/CipherValue&gt;
          &lt;/CipherData&gt;
          &lt;ReferenceList&gt;
            &lt;DataReference URI="#encrypt" /&gt;
          &lt;/ReferenceList&gt;
        &lt;/EncryptedKey&gt;
        &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;SignedInfo&gt;
            &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
            &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
            &lt;Reference URI="#body"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removeddigestvalue&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#timestamp"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;removeddigestvalue&lt;/DigestValue&gt;
            &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
          &lt;SignatureValue&gt;
          removed&lt;/SignatureValue&gt;
          &lt;KeyInfo&gt;
            &lt;wsse:SecurityTokenReference&gt;
              &lt;wsse:Reference URI="#binary_security_token"
              ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /&gt;
            &lt;/wsse:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
        &lt;/Signature&gt;
      &lt;/wsse:Security&gt;
    &lt;/soap:Header&gt;
    &lt;soap:Body xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
    id="body" u:Id="body"&gt;
      &lt;EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#"
      Id="encrypt" Type="http://www.w3.org/2001/04/xmlenc#Content"&gt;
        &lt;EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" /&gt;
        &lt;CipherData&gt;
          &lt;CipherValue&gt;
          removed&lt;/CipherValue&gt;
        &lt;/CipherData&gt;
      &lt;/EncryptedData&gt;
    &lt;/soap:Body&gt;
  &lt;/soap:Envelope&gt;
  </code></pre>