Solved

WCF binding security mode in app config is confusing

Posted on 2010-08-21
1
1,744 Views
Last Modified: 2012-05-10
I am confused by some of the security settings in WCF, when you are making configuration settings in the host app config.  The issue centers on the following nodes:
<binding>
  <security mode = "" >
     <transport ...  />
     <message .... />

Learning WCF, by Bustamante, says that the defaults for wsHttpBinding and netTcpBinding are:

<binding>    <!-- for wsHttpBinding  -->
  <security mode = "Message" >
     <transport ...  />
     <message .... />

<binding>    <!-- netTcpBinding  -->
  <security mode = "Transport" >
     <transport ...  />
     <message .... />

What confuses me is why are both <transport> and <message> used?  For all the other standard bindings defaults the @mode value and the child element to <security> match up one-to-one.  (If mode=Message then they use security/message; if mode=transport, then they use security/trnasport)

I guess I dont understand the meaning of <security mode="" >   The text (and msdn) explains "mode" with statements like, "this configures the binding for transport security" or "this configures the binding for message security"

What are the meanings of security/@mode and security/transport and security/message; and how do the interact and/or depend on each other?
0
Comment
Question by:pdschuller
1 Comment
 
LVL 3

Accepted Solution

by:
with earned 500 total points
ID: 33494378
The "mode" is the controlling factor; it establishes how security is going to work.  Beyond that, additional configuration information will be read from child elements <transport> and <message>, if present, and as they pertain to the selected mode.

Depending on your selected mode, <transport> or <message> may not be applicable.  For instance, mode "None" disables security and anything else you put in there gets ignored.  Because some modes like TransportWithMessageCredential use both elements <transport> and <message>, these elements must both remain simultaneously permissible by the XML schema itself.  Whether they'll actually be used depends on the mode.

0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This tutorial will show you how to add an attribute to an XML (http://en.wikipedia.org/wiki/XML) stream returned from a Windows Communication Foundation (http://en.wikipedia.org/wiki/Windows_Communication_Foundation) (WCF) Web Service.  Some knowled…
In previous Articles, we have discussed how we can upload a file using .asmx web service and isolated storage space. Here, in continuation to the topic, I am going to discuss how we can use WCF for the same purpose. Steps: 1.Create the silverli…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question