title: How to get WCF and Java clients to work. Expert help needed
body: <p><strong>Background (a wee bit long)</strong>:</p>
  
  <p>A few years back I wrote for a customer a WCF service that is configured to use the basicHttpBinding with security mode = "Transport" with clientCredentialType = "Certificate", i.e. the clients are authenticating themselves using a (client) certificate. The service employs a custom AuthorizationManager that checks if the thumbprint of the incoming certificate is present in a predefined list of valid certificate thumbprints. If the incoming certificate is deemed valid, the operation is allowed to continue (if not, an exception is thrown).</p>
  
  <p>The service has worked flawlessly for approximately four years and everyone's been happy. However, as so often happens requirements change and recently my customer has been approached by developers wishing to connect their applications to my customer's service. The only problem is that these developers are using some variant of Java as their preferred platform and now we are facing some serious problems. To make a long story short, no one has managed to get their Java implementation (e.g. Metro, Axis2) to work with the service as it is presently configured.</p>
  
  <p>Last week we tried getting it to work with a client written in Java (Metro, JAX-WS) by changing the binding to the wsHttpBinding with security mode = "TransportWithMessageCredential" with Message clientCeredentialType = "UserName". I also added a custom UserNamePassWordValidatorType to the service credentials element in the config file. </p>
  
  <p>I then commented out the custom AuthorizationManager since no certificate was coming from the client. </p>
  
  <p>Lo' and behold, this time we got both SoapUI and the Java client proper to talk to the service.</p>
  
  <p>(Btw, our service is self-hosted in a Windows Service)</p>
  
  <p>Happy as can be, we decided to configure the service with two bindings, the existing basicHttpBinding that's been working without a glitch for a long time, and the newly tested wsHttpBinding. So we would have something like:</p>
  
  <pre><code>&lt;services&gt;
      &lt;service name="SuperDuperService" behaviorConfiguration="superDuperBehaviour"&gt;
          &lt;endpoint binding="basicHttpBinding" contract="ISuperDuperService" bindingConfiguration="SecureTransport"/&gt;
          &lt;endpoint binding="wsHttpBinding" address="stws" contract="ISuperDuperService" bindingConfiguration="SecureTransportAndSoap"/&gt;
          &lt;endpoint binding="mexHttpsBinding" address="mex" contract="IMetadataExchange" /&gt;
          &lt;host&gt;
              &lt;baseAddresses&gt;
                  &lt;add baseAddress="https://&lt;url + port&gt;/SuperDuperService"/&gt;
              &lt;/baseAddresses&gt;
          &lt;/host&gt;
      &lt;/service&gt;
  &lt;/services&gt;
  &lt;bindings&gt;
      &lt;basicHttpBinding&gt;
          &lt;binding name="SecureTransport" maxBufferSize="2065536" maxBufferPoolSize="524288" maxReceivedMessageSize="2065536"&gt;
              &lt;security mode="Transport"&gt;
                  &lt;transport clientCredentialType="Certificate"/&gt;
              &lt;/security&gt;
              &lt;readerQuotas maxDepth="32" maxStringContentLength="6553600" maxArrayLength="2065536"
                  maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
          &lt;/binding&gt;
      &lt;/basicHttpBinding&gt;
      &lt;wsHttpBinding&gt;
          &lt;binding name="SecureTransportAndSoap"&gt;
              &lt;security mode="TransportWithMessageCredential"&gt;
                  &lt;message clientCredentialType="UserName"/&gt;
              &lt;/security&gt;
          &lt;/binding&gt;
      &lt;/wsHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;behaviors&gt;
      &lt;serviceBehaviors&gt;
          &lt;behavior name="superDuperBehaviour"&gt;
              &lt;serviceCredentials&gt;
                  &lt;!-- The following element specifies the certificate use by this service for HTTPS (SSL) based transport security --&gt;
                  &lt;serviceCertificate findValue="&lt;some identifier&gt;"
                          storeLocation="LocalMachine"
                          storeName="My"
                          x509FindType="FindBySubjectName" /&gt;
                  &lt;userNameAuthentication userNamePasswordValidationMode ="Custom" customUserNamePasswordValidatorType 
  
  ="SupportClasses.CustomUserNameValidator,SupportClasses"/&gt;
              &lt;/serviceCredentials&gt;
              &lt;!-- The following element specifies how we're authorizing based on the client certificates received --&gt;
              &lt;serviceAuthorization serviceAuthorizationManagerType="SupportClasses.AuthorizationManager, SupportClasses"/&gt;
              &lt;serviceMetadata httpsGetEnabled="true"/&gt;
              &lt;serviceDebug includeExceptionDetailInFaults="false"/&gt;
          &lt;/behavior&gt;
      &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  </code></pre>
  
  <p>So where is the problem you may ask? Well, see that <code>&lt;serviceBehavior&gt;</code> element? As you well may know this element applies globally to the service meaning that during run-time both the CustomUserNameValidator and the AuthorizationManager will be called. The latter will complain that there is no certificate present when a client calls the service using the wsHttpBinding! </p>
  
  <p>Argh! </p>
  
  <p><strong>Alternative solutions</strong>.</p>
  
  <p>So far, these are the alternative solutions I have come up with:</p>
  
  <p><em>Alternative 1)</em> Create another Windows Service hosting our WCF service on a different URL. Then both services will have a separate configuration.</p>
  
  <p><em>Alternative 2)</em> Create two service implementations hosted in the same Windows Service and expose them both in the  element each with their own binding and serviceBehaviour</p>
  
  <p><em>Alternative 3)</em> Figure out if it is at all possible to keep the current configuration and have the CustomUserNameValidator and the AuthorizationManager coexist peacefully</p>
  
  <p>Sorry for this long post, but I needed to be thorough when providing the background for my question(s).</p>
  
  <p><em>Question 1)</em> Has anyone gotten WCF to work with Java clients using nontrivial configurations?</p>
  
  <p><em>Question 2)</em> Has anyone got a suggestion on how to solve alternative 3? (if at all possible)</p>
  
  <p><em>Question 3)</em> Which one, if any, of the above alternatives, would you recommend?</p>
  
  <p><em>Question 4)</em> Is there other alternatives you know of that I haven't thought of?</p>
  
  <p>For the record, I've looked into the WCF interoperability tool, but I can't really see how it can help us. If anyone reading this has had good results using the interoperability "wizard", </p>
  
  <p>please let me know.</p>
  
  <p>Thanks in advance.</p>
  
  <p>--norgie</p>