title: WCF client passing username token with mustUnderstand set to true
body: <p>I'm tasked with creating a WCF service that will be consumed by an external client. The client is using WSSE security, specifically, they're passing a username token via a SOAP header. </p>
  
  <p>The WCF service is hosted on an IIS server with SSL enabled.</p>
  
  <p>At this point, I have a semi-working prototype. The issue I'm dealing with now is that the SOAP header has the mustUnderstand attribute set to 1, and this causes the process to fail. </p>
  
  <p>I'd like some advice (or better yet, a code example <em>smiles</em>) on how to handle the username token in such a fashion as to return the proper response when the mustUnderstand attribute is true.</p>
  
  <p>Here's a sample of the SOAP request that's failing:</p>
  
  <pre><code>    &lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/"&gt;
         &lt;soapenv:Header&gt;
            &lt;wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
               &lt;wsse:UsernameToken&gt;
                  &lt;wsse:Username&gt;TestUser&lt;/wsse:Username&gt;
                  &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;TestPWD&lt;/wsse:Password&gt;
                  &lt;wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;NzU3MjFhN2YtYTlmYS00ZWZjLTkxNjktY2ExZjlkZDEwNzE5&lt;/wsse:Nonce&gt;
                  &lt;wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2011-10-26T03:04:39Z&lt;/wsu:Created&gt;
               &lt;/wsse:UsernameToken&gt;
            &lt;/wsse:Security&gt;
         &lt;/soapenv:Header&gt;
         &lt;soapenv:Body&gt;
            &lt;tem:Getstuff&gt;
               &lt;tem:Arg1&gt;Arg1&lt;/tem:Arg1&gt;
               &lt;tem:Arg2&gt;Arg2&lt;/tem:Arg2&gt;
            &lt;/tem:Getstuff&gt;
         &lt;/soapenv:Body&gt;
      &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>If soapenv:mustUnderstand="1" is changed to soapenv:mustUnderstand="0", then the process works.</p>
  
  <hr>
  
  <p>PS: Here's a revised sample request the client sent:</p>
  
  <pre><code>    &lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"&gt;
        &lt;s:Header&gt;
          &lt;Action s:mustUnderstand="1" xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none"&gt;http://tempuri.org/WService/Getstuff&lt;/Action&gt;
          &lt;Security xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
            &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="removed" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
              &lt;wsse:Username&gt;TestUser&lt;/wsse:Username&gt;
              &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;TestPass&lt;/wsse:Password&gt;
              &lt;wsse:Nonce&gt;2Udx78sh2y2xRJYJpZZ9+w==&lt;/wsse:Nonce&gt;
              &lt;wsu:Created&gt;2011-09-26T19:12:48Z&lt;/wsu:Created&gt;
            &lt;/wsse:UsernameToken&gt;
          &lt;/Security&gt;
        &lt;/s:Header&gt;
        &lt;s:Body&gt;
          &lt;Getstuff xmlns="http://tempuri.org/"&gt;
           &lt;Arg1&gt;Arg1&lt;/Arg1&gt;
           &lt;Arg2&gt;Arg2&lt;/Arg2&gt;
          &lt;/Getstuff&gt;
        &lt;/s:Body&gt;
      &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>I receive the following response to the above requests:</p>
  
  <pre><code>    &lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"&gt;
         &lt;s:Body&gt;
            &lt;s:Fault&gt;
               &lt;faultcode&gt;s:MustUnderstand&lt;/faultcode&gt;
               &lt;faultstring xml:lang="en-US"&gt;The header 'Security' from the namespace 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' was not understood by the recipient of this message, causing the message to not be processed.  This error typically indicates that the sender of this message has enabled a communication protocol that the receiver cannot process.  Please ensure that the configuration of the client's binding is consistent with the service's binding.&lt;/faultstring&gt;
            &lt;/s:Fault&gt;
         &lt;/s:Body&gt;
      &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>Here's the binding:</p>
  
  <pre><code>&lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="TransportBind" maxBufferSize="2147483647" maxBufferPoolSize="2147483647"
        maxReceivedMessageSize="2147483647"&gt;
        &lt;readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647"
          maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" /&gt;
        &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="None" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
      &lt;binding name="basic" maxBufferSize="2147483647" maxBufferPoolSize="2147483647"
        maxReceivedMessageSize="2147483647"&gt;
        &lt;readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647"
          maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" /&gt;
      &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  </code></pre>