WCF Authentication - TransportCredentialOnly with ASPNET Membership - asp.net

Question

I feel like I'm close but I'm a newbie at WCF and can't figure out why this is not working. I've tried searching, but I couldn't find an example of using aspnet membership without using message level security. I am trying to authenticate over https from Android to a WCF service. It works just fine until I change the clientCredentialType from 'None' to 'Basic'. I have to authenticate via username and password. When I try to update my proxy by running slsvcutil.exe against the https://myPublicWebsite/ABCService/ABC.svc it gives the following error:
The authentication schemes configured on the host ('IntegratedWindowsAuthentication, Anonymous') do not allow those configured on the binding 'BasicHttpBinding' ('Basic'). Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly. Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.
Here is my web.config of the service. Thanks for any help you can give me.
<system.web>
<compilation debug="false" strict="false" explicit="true" targetFramework="4.0" />
<customErrors mode="Off" />
<membership defaultProvider="AspNetSqlMembershipProvider" userIsOnlineTimeWindow="15">
<providers>
<remove name="AspNetSqlMembershipProvider" />
<clear />
<add
name="AspNetSqlMembershipProvider"
type="System.Web.Security.SqlMembershipProvider"
connectionStringName="LocalSqlServer"
applicationName="ABC"
enablePasswordRetrieval="false"
enablePasswordReset="false"
requiresQuestionAndAnswer="false"
minRequiredPasswordLength="8"
requiresUniqueEmail="true"
passwordFormat="Hashed" />
</providers>
</membership>
</system.web>
<system.serviceModel>
<services>
<service name="ABCService.ABC" behaviorConfiguration="metadataBehavior">
<endpoint
address=""
binding="basicHttpBinding"
bindingConfiguration="ABCBinding"
contract="ABCService.IService1"/>
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="metadataBehavior">
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="false"/>
<serviceCredentials>
<userNameAuthentication
userNamePasswordValidationMode="MembershipProvider"
membershipProviderName="AspNetSqlMembershipProvider" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<basicHttpBinding>
<binding name="ABCBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Basic" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<protocolMapping>
<add binding="basicHttpsBinding" scheme="https"/>
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/>
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
<directoryBrowse enabled="false"/>
</system.webServer>
Also, what do I put in the code of service to run the validation check? I have this:
Public Class MyCustomUserNameValidator
Inherits IdentityModel.Selectors.UserNamePasswordValidator
' This method validates users. It allows two users, test1 and test2
' with passwords 1tset and 2tset respectively.
' This code is for illustration purposes only and
' MUST NOT be used in a production environment because it is NOT secure.
Public Overrides Sub Validate(ByVal userName As String, ByVal password As String)
If Nothing = userName OrElse Nothing = password Then
Throw New ArgumentNullException()
End If
If Not (userName = "test1" AndAlso password = "1tset") AndAlso Not (userName = "test2" AndAlso password = "2tset") Then
Throw New IdentityModel.Tokens.SecurityTokenException("Unknown Username or Password")
End If
End Sub
End Class
But I don't really understand how it works because I never call it, and I would rather use a default one than a custom one. I'm sure this is simple, but all the examples I could find by searching are for 'custom' validators. Does this get called automatically? or do I even need it if I just want the default?

Answer 1

Are you using IIS? you need to install and enable basic authentication in IIS.
To install: Turn On or Off Windows Components, and enable Basic
Authentication under IIS.
To enable:
http://technet.microsoft.com/en-us/library/cc772009(v=ws.10).aspx
However, even if you enabled basic auth, you can only use membership providers and custom validators in message based security and when clientCredentialType set to UserName. Pure transport based security mode like TransportCredentialOnly and Transport will not work.
Reference - go to the Authentication section
This should work for wsHttpBinding
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
Another possibility for wsHttpBinding and basicHttpBinding
<security mode="TransportWithMessageCredential">
<message clientCredentialType="UserName" />
</security>