Last post Aug 04, 2017 07:13 PM by DA924
Jul 25, 2017 05:54 PM|esr124|LINK
I created a very simple WCF service library and then a WCF service application. I was able to deploy the app to IIS on a server. The URL to the .svc was accessible through my browser and I even created a Windows console application to test calling the
web service from code. Everything worked just fine. But, I need to add authentication with a username/password. I did some research and found an example that had me create a new class that inherited from UserNamePasswordValidator and then made changes to
my web.config. After testing everything locally I tried deploying the app to the server again. This time the URL to the .svc would not resolve. And my command line application gives me a strange error saying :
"Client found response content type of '', but expected 'text/xml'.".
Below is the web.config with the changes I made for the authentication commented out:
<add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
<compilation debug="true" targetFramework="4.5" />
<service name="ServiceLib.HelloService" behaviorConfiguration="ServicesBehavior">
<endpoint address="" binding="wsHttpBinding" contract="ServiceLib.IHelloService" bindingConfiguration="ServicesConfig"></endpoint>
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<authentication certificateValidationMode="None" />
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="ServiceLib.ServiceAuthenticator,ServiceLib" />
<serviceCertificate findValue="Services" x509FindType="FindBySubjectName" storeName="My" storeLocation="CurrentUser" />
<add binding="basicHttpsBinding" scheme="https" />
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
Using the web.config with everything regarding the authentication commented out I can get my web service to work again, but I need to have username/password authentication.
Any help would be greatly appreciated.
Jul 26, 2017 03:00 AM|Edward Z|LINK
>> After testing everything locally I tried deploying the app to the server again. This time the URL to the .svc would not resolve.
Did you mean it works at local, but failed at server? If so, could you share us the error message when you access .svc address?
>> <serviceCertificate findValue="Services" x509FindType="FindBySubjectName" storeName="My" storeLocation="CurrentUser" />
For this configuration, the service will look for Services certificate on server. Is there any certificate named Services on server? If not, you need to install the certificate.
After the .svc file could be access, you will need to update the service reference before running the application.
Aug 01, 2017 01:20 PM|esr124|LINK
Is there a way to use custom username/password without the certificate?
I don't want to overcomplicate things but I need some authentication.
Aug 02, 2017 03:18 AM|Edward Z|LINK
For built-in custom username/password, the certificate which is used to encrypt the message or transport it required, otherwise, your username/password will be plaintext while transfer between client and service.
As my understanding, certificate should not be a complex problem, you could purpose it, install it to certificate store, and then reference it from wcf service.
If you insist on username/password without certificate, you could store them in header and then validate them in service side from header, but they will be in plaintext which mean who could capture the request will see the user name and password.
Aug 04, 2017 07:13 PM|DA924|LINK
You have to tell the WCF client what type of context-type it is to expect, But that doesn't seem to be happening in what you're doing, because the WCF sends text/xml normally.
After testing everything locally I tried deploying the app to the server again.
That kind of tells me you did it with IIS Express instead of developing with VS against local IIS the real one. Now you deploy to a real IIS and the problem is exposed.