title: Using SoapUI to test a WCF with Basic Authentication
body: <p>I am new to web service. I want to write a simple WCF with username and password authentication. When using SoapUI for testing, if the security mode is set to none (without basic authentication), it can be called successfully. Once the security mode is set to message (with basic authentication), it cannot return the correct result. Both of them can be called successfully using C# client. 
  I have applied many suggestions on StackOverflow but still cannot get the correct result. </p>
  
  <ul>
  <li>In the 'Request Properties' in SoapUI in section 'Wss-Password Type'
  just select option 'PasswordText'.</li>
  <li>negotiateServiceCredential="true"</li>
  <li>Check mark "Add default WSA To"</li>
  <li>In http setting check “add authentication information for outgoing result”</li>
  </ul>
  
  <p>Is there any additional setting need to be done, like configure the certificate? I am looking forward to your help.</p>
  
  <p>The setting details are listed below.</p>
  
  <p>When security mode is set to message, the return result is </p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"&gt;
     &lt;s:Header&gt;
        &lt;a:Action s:mustUnderstand="1"&gt;http://www.w3.org/2005/08/addressing/soap/fault&lt;/a:Action&gt;
     &lt;/s:Header&gt;
     &lt;s:Body&gt;
        &lt;s:Fault&gt;
           &lt;s:Code&gt;
              &lt;s:Value&gt;s:Sender&lt;/s:Value&gt;
              &lt;s:Subcode&gt;
                 &lt;s:Value xmlns:a="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;a:InvalidSecurity&lt;/s:Value&gt;
              &lt;/s:Subcode&gt;
           &lt;/s:Code&gt;
           &lt;s:Reason&gt;
              &lt;s:Text xml:lang="zh-HK"&gt;An error occurred when verifying security for the message.&lt;/s:Text&gt;
           &lt;/s:Reason&gt;
        &lt;/s:Fault&gt;
     &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>The SoapUI log:</p>
  
  <p>DEBUG:Attempt 1 to execute request
  DEBUG:Sending request: POST /ServiceHello.svc HTTP/1.1
  DEBUG:Receiving response: HTTP/1.1 500 Internal Server Error
  DEBUG:Connection can be kept alive indefinitely
  INFO:Got response for [WSHttpBinding_IServiceHello.HelloWorld:Request 1] in 3ms (576 bytes)</p>
  
  <p>Result for security mode=none</p>
  
  <pre><code> &lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"&gt;
     &lt;s:Header&gt;
        &lt;a:Action s:mustUnderstand="1"&gt;http://tempuri.org/IServiceHello/HelloWorldResponse&lt;/a:Action&gt;
     &lt;/s:Header&gt;
     &lt;s:Body&gt;
        &lt;HelloWorldResponse xmlns="http://tempuri.org/"&gt;
           &lt;HelloWorldResult&gt;Hello World&lt;/HelloWorldResult&gt;
        &lt;/HelloWorldResponse&gt;
     &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>And this is the web.config</p>
  
  <pre><code>&lt;add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" /&gt;
    &lt;/appSettings&gt;
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime targetFramework="4.5"/&gt;
    &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
      &lt;services&gt;
        &lt;service name="WCFTest.ServiceHello"
                 behaviorConfiguration="WCFTest_Behavior"&gt;
          &lt;endpoint 
            address="" 
            binding="wsHttpBinding" 
            contract="WCFTest.IServiceHello"
            bindingConfiguration="WCFTest_Config"&gt;
          &lt;/endpoint&gt;
  
        &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="WCFTest_Config"&gt;
  &lt;security mode="None"&gt;
  &lt;!—The only difference between two web service is the security mode, which is set to message in the authentication version --&gt;            
              &lt;message clientCredentialType="UserName" negotiateServiceCredential="false"
              establishSecurityContext="false" algorithmSuite="Default"/&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="WCFTest_Behavior"&gt;
            &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
            &lt;serviceCredentials&gt;
              &lt;clientCertificate&gt;
                &lt;authentication certificateValidationMode="None"/&gt;
              &lt;/clientCertificate&gt;
              &lt;userNameAuthentication userNamePasswordValidationMode="Custom"                  customUserNamePasswordValidatorType="WCFTest.App_Code.Authentication.CustomValidator,App_Code/Authentication"/&gt;
              &lt;serviceCertificate 
                findValue="myCertificate"
                storeLocation="LocalMachine"
                storeName="My"
                x509FindType="FindBySubjectName" /&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;protocolMapping&gt;
          &lt;add binding="basicHttpsBinding" scheme="https" /&gt;
      &lt;/protocolMapping&gt;    
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
    &lt;/system.serviceModel&gt;
    &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"/&gt;
      &lt;directoryBrowse enabled="true"/&gt;
    &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>