Customize security for WCF-type Web services

Relevant for: API testing only

This section describes how to customize the security settings for Web services using WCF.

Create a WCF scenario

  1. Open the Security Settings dialog box in one of the following ways:

    • For port level security, right-click a service's port in the Toolbox pane and select Security Settings.

    • For step level security, open the Security Settings tab in the Properties pane. Clear the Use the port's security settings option.

  2. In the Security Settings dialog box, select the type of WCF Service from the Service Details dropdown list.

Back to top

Web Service using WSHTTPBinding

  1. At the top of the Security Settings dialog box, in the dropdown list, select WCF Service (WSHttpBinding).

  2. In the Client authentication type dropdown list, choose a client credential type to use in your binding—Windows, Certificate, or Username. This value corresponds to the MessageClientCredentialType property of the WCF's WSHttpBinding parameter.

    Windows authentication is the most common value for a WCF services. If you are using the WCF default settings for your service, use this option.

  3. Define the security settings for your authentication type. The available options differ per authentication type.

    Note: For some scenarios you should indicate whether to use the WCF proprietary negotiation mechanism to get the service credentials.

  4. Click Advanced to control the usage of a secure session.

Back to top

Web Service using CustomBinding

  1. In the Security Settings dialog box, in the dropdown list, select the WCFService (Custom Binding) scenario.

  2. In the main pane of the Security Settings dialog box, set the Web service security options, including:

    • Transport type

    • Encoding

    • Authentication mode for the Web service

    • Net security type

    • The identities for the custom bindings and authentication certificate

    • The client user information for the "user" who would access the Web service

Back to top

WCF Federation Web service

  1. In the Security Settings dialog box, in the dropdown list, select the WCFService Federation scenario.

  2. Provide the service and security transport details, including:

    • Transport type

    • Encoding

    • Authentication mode for the Web service

    • Bootstrap policy for the Web service

    • The identities for the custom bindings and authentication certificate

    • STS (Security Token Service) settings

Note: You must to define the communication properties for both the STS and the application server

Back to top

WCF service using netTcp or namedPipe transport

  1. In the Security Settings dialog box, from the dropdown list, select the WCFService (Custom Binding) scenario.

  2. Set the Transport option to TCP or NamedPipe.

  3. Set the other security settings as described in Web Service using CustomBinding.

Back to top

Web service using WSE3 security configuration with a server certificate

  1. Create a new test and import a WSDL containing the W3E3 service.

  2. Add a method from the Web service to the canvas.

  3. In the Properties pane, select the Security Settings tab , or in the Toolbox pane right-click the Web service node and select Security Settings.

  4. In the Security Settings dialog box, from the dropdown list, select the WCFService (Custom Binding) scenario.

  5. In the main pane of the Security Settings dialog box, set the Transport option to HTTP, and the Encoding to Text.

  6. In the Identities section, enter a username and password.

  7. Click the Browse button adjacent to the Server Certificate field and specify the Store Location, Store Name and Search text (optional). Click Find, select the certificate, and click Select.

  8. Provide the Expected DNS.

  9. Click the Advanced button and configure the following settings in the Advanced Settings dialog box:

    1. In the Encoding tab: Set the WS-Addressing version appropriately

    2. In the Security tab, set the following options:

      • Enable secure session: Enabled

      • Negotiate service credentials: Enabled

      • Protection level: Encrypt and Sign

      • Message protection order: Sign Before Encrypt

      • Message security version: WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005 (first entry)

      • Require Derived keys: Enabled

      For all other fields, use the default settings.

Back to top

WCF service using mutual certificate authentication

The following procedure describes how to set up a security scenario for mutual certificates and how to comply with a WSE3 security configuration.

  1. In the Security Settings dialog box, from the dropdown list, select the WCFService (CustomBinding) scenario.

  2. Set the Transport option to HTTP, and the Encoding to Text.

  3. Set the authentication mode to MutualCertificate.

  4. In the Identities section, select the server and client certificates.

  5. Provide the Expected DNS.

  6. Click the Advanced button and configure the following settings in the Advanced Settings dialog box:

    1. Encoding tab—WS-Addressing: WSA 04/08 (for a WSE3 security configuration).

    2. Security tab—Require Derived keys: Disabled

    For all other fields, use the default settings.

Back to top

WCF scenario using binding with TCP transport to require an X.509 client certificate

The following procedure describes how to configure a WCF custom scenario to require an X.509 client certificate in nettcp.

  1. In the Security Settings dialog box, from the dropdown list, select the WCFService (Custom Binding) scenario.

  2. Set the Transport to TCP and the Net Security to SSL stream security.

  3. In the Properties pane, open the Events tab .

  4. IIn the events list, select the BeforeApplyProtocolSettings event. Click in the Handler column and select Create a default handler from the drop-down.

  5. In the TestUserCode.cs file, locate the TODO section of the code and add the following definitions.

    
var wcf = (HP.ST.Ext.CommunicationChannels.Models.WcfChannelBinding)args[1];
var ssl =
       (HP.ST.Ext.CommunicationChannels.Models.WcfSslStreamSecurityChannel)wcf.
         Protocols.Channels[1];
ssl.RequireClientCertificate = true;

    For all other fields, use the default settings.

Back to top