title: With C#, WCF SOAP consumer that uses WSSE plain text authentication?
body: <p>I have a WCF SOAP consumer that is implemented by Visual Studio 2012 from a WSDL. The WSDL was generated by PeopleTools. The base object is of type <code>System.ServiceModel.ClientBase</code>.</p>
  
  <p>I need the SOAP request to resemble:</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sch="http://xmlns.oracle.com/Enterprise/Tools/schemas"&gt;
      &lt;soapenv:Header&gt;
          &lt;wsse:Security soap:mustUnderstand="1" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
              &lt;wsse:UsernameToken&gt;
                  &lt;wsse:Username&gt;[plain text username goes here]&lt;/wsse:Username&gt;
                  &lt;wsse:Password&gt;[plain text password goes here]&lt;/wsse:Password&gt;
              &lt;/wsse:UsernameToken&gt;
          &lt;/wsse:Security&gt;
      &lt;/soapenv:Header&gt;
      &lt;soapenv:Body&gt;
          &lt;sch:InputParameters&gt;
              &lt;Last_Name&gt;Aren&lt;/Last_Name&gt;
              &lt;First_Name&gt;Cambre&lt;/First_Name&gt;
          &lt;/sch:InputParameters&gt;
      &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>Here's the closest we can get:</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"&gt;
      &lt;s:Header&gt;
          &lt;a:Action s:mustUnderstand="1"&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue&lt;/a:Action&gt;
          &lt;a:MessageID&gt;urn:uuid:3cc3f2ca-c647-466c-b38b-f2423462c837&lt;/a:MessageID&gt;
          &lt;a:ReplyTo&gt;
              &lt;a:Address&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
          &lt;/a:ReplyTo&gt;
          &lt;a:To s:mustUnderstand="1"&gt;http://[internal URL to soap listener]&lt;/a:To&gt;
      &lt;/s:Header&gt;
      &lt;s:Body&gt;
          &lt;t:RequestSecurityToken Context="uuid-7db82975-2b22-4236-94a1-b3344a0bf04d-1" xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"&gt;
              &lt;t:TokenType&gt;http://schemas.xmlsoap.org/ws/2005/02/sc/sct&lt;/t:TokenType&gt;
              &lt;t:RequestType&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/Issue&lt;/t:RequestType&gt;
              &lt;t:KeySize&gt;256&lt;/t:KeySize&gt;
              &lt;t:BinaryExchange ValueType=" http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;FgMBAFoBAABWAwFQ9IhUFGUO6tCH+0baQ0n/3us//MMXzQA78Udm4xFj5gAAGAAvADUABQAKwBPAFMAJwAoAMgA4ABMABAEAABX/AQABAAAKAAYABAAXABgACwACAQA=&lt;/t:BinaryExchange&gt;
          &lt;/t:RequestSecurityToken&gt;
      &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>You'll notice two problems:</p>
  
  <ul>
  <li>No plaintext WSSE credentials. Passes a binary form of the credentials that the service won't use.</li>
  <li>Authentication is in <code>Body</code>, not <code>Header</code>.</li>
  <li>The request omits <code>InputParameters</code>.</li>
  </ul>
  
  <p>Here's the essential C# code:</p>
  
  <pre><code>var service = new ServiceWithBizarreNameFromPeoplesoft();
  
  if (service.ClientCredentials == null)
     throw new NullReferenceException();
  service.ClientCredentials.UserName.UserName = "test";
  service.ClientCredentials.UserName.Password = "password";
  
  var binding = new WSHttpBinding(SecurityMode.TransportWithMessageCredential) {Security = new WSHttpSecurity()};
  service.Endpoint.Binding = binding;
  
  binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
  binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
  binding.Security.Mode = SecurityMode.Message;
  
  var input = new InputParameters { Last_Name = "Cambre", First_Name = "Aren" };
  
  var returnData = service.BizarrePeopleSoftNameForMethod(input);
  </code></pre>
  
  <p>There's no HTTP layer security, and transport is SSL-encrypted. Authentication is only based on the SOAP message.</p>