yaronn / clearusernamebinding

A full tutorial is here.

You can also check my twitter.

ClearUsernameBinding

Wcf does not natively allow to send username token over an unsecured transport (namely non-ssl). Trying to do so will results in one out of many errors, typically this one:

The provided URI scheme 'http' is invalid; expected 'https'. Parameter name: via

In some cases this is a legitimate use case. Consider the use of a load balancer, or an internal secured network.

ClearUsernameBinding allows to do this using a very simple configuration.

How to use ClearUsernameBinding?

A full tutorial is here.

License

MIT: http://rem.mit-license.org/

clearusernamebinding's Issues

test

Question for you

So i was checking out this repo, because I find development with wcf is painful. I need to secure a wcf service, but i refuse to have to run terminal commands to bind a certificate to a port just to get https to work. All the services are behind traefik which handles ssl with lets encrypt. So if i can develop and use localhost, and then when i deploy behind traefik it still just keeps working, that would be great. I notice that this handles the client credentials, but does not handle that the wsdl still has localhost. Any thoughts on how to accomplish rewriting the urls that are in wsdl so they use correct url with https://mydomain.com?

Password format

Hi,

I'm using ClearUsernameBinding in order to authenticate against a SOAP service with username/password and without SSL.

My issue is that the security header generated doesn't include the password type:

Actual header:

    ```<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <o:UsernameToken u:Id="uuid-74ef7289-eccf-4890-a438-38654752b005-1">
            <o:Username>USERNAME</o:Username>
            <o:Password>PASSWORD</o:Password>
        </o:UsernameToken>
    </o:Security>```

What I need:

    ```<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <o:UsernameToken u:Id="uuid-74ef7289-eccf-4890-a438-38654752b005-1">
            <o:Username>USERNAME</o:Username>
            <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">PASSWORD</o:Password>
        </o:UsernameToken>
    </o:Security>```

Is there a way to add the password type without editing the ClearUsernameBinding DLL ?