title: Accidentally sticking SOAP Body inside of SOAP Header attempting to access WSE service with WCF client
body: <p>I am attempting to hit a WSE secured web service using WCF.  The SOAP header I need to generate to do this should contain a username, password, nonce, and created date... Here is a an example of a soap UI header that I use to hit the same service...</p>
  <pre><code>   &lt;soap:Header&gt;
        &lt;wsse:Security soap:mustUnderstand=&quot;true&quot; xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot;&gt;
           &lt;wsse:UsernameToken wsu:Id=&quot;UsernameToken-2&quot; xmlns:wsu=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd&quot;&gt;
              &lt;wsse:Username&gt;----------&lt;/wsse:Username&gt;
              &lt;wsse:Password Type=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText&quot;&gt;----------&lt;/wsse:Password&gt;
              &lt;wsse:Nonce EncodingType=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary&quot;&gt;Hozef94FFwOhuiF5QixaMQ==&lt;/wsse:Nonce&gt;
              &lt;wsu:Created&gt;2012-08-21T13:26:03.642Z&lt;/wsu:Created&gt;
           &lt;/wsse:UsernameToken&gt;
        &lt;/wsse:Security&gt;
     &lt;/soap:Header&gt;
  </code></pre>
  <p>Now I found a tutorial that was pretty usefull.  <a href="http://blog.benpowell.co.uk/2010/11/supporting-ws-i-basic-profile-password.html" rel="nofollow noreferrer">usefull tutorial</a></p>
  <p>I have successfully implemented it... But I am now sticking the SOAP body into the soap header and there isn't a nonce generated.</p>
  <pre><code>&lt;s:Envelope xmlns:s=&quot;http://www.w3.org/2003/05/soap-envelope&quot;&gt;
      &lt;s:Header&gt;
          &lt;VsDebuggerCausalityData xmlns=&quot;http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink&quot;&gt;uIDPo9VZylDHg5JMgjsNnWLhATkAAAAA+YtOxHdh0Uqd4a64raX/nIzYz20mPHlBv4Wk5S8d5PsACQAA&lt;/VsDebuggerCausalityData&gt;
          &lt;wsse:Security s:mustUnderstand=&quot;0&quot; xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot; xmlns:s=&quot;http://schemas.xmlsoap.org/soap/envelope/&quot;&gt;
              &lt;UsernameToken xmlns=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot;&gt;
                  &lt;Username&gt;------------&lt;/Username&gt;
                  &lt;Password&gt;************&lt;/Password&gt;
              &lt;/UsernameToken&gt;
          &lt;/wsse:Security&gt;
          &lt;s:Body xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xmlns:xsd=&quot;http://www.w3.org/2001/XMLSchema&quot;&gt;
              &lt;GetOrganizations xmlns=&quot;http://------------------------/businessobjects/messaging/&quot;&gt;
                  &lt;personId xmlns=&quot;&quot;&gt;0&lt;/personId&gt;
                  &lt;typeId xmlns=&quot;&quot;&gt;
                      &lt;int&gt;1&lt;/int&gt;
                      &lt;int&gt;2&lt;/int&gt;
                      &lt;int&gt;3&lt;/int&gt;
                      &lt;int&gt;4&lt;/int&gt;
                  &lt;/typeId&gt;
              &lt;/GetOrganizations&gt;
          &lt;/s:Body&gt;
      &lt;/s:Header&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  <p>Don't know why it is doing this.  I followed the tutorial to the letter.  My Repository getting everything...</p>
  <pre><code>using (DistListServiceReference.DistributionListClient dlc = new DistListServiceReference.DistributionListClient())
              {
                  try
                  {
                      PasswordDigestBehavior behavior = new PasswordDigestBehavior(&quot;********&quot;, &quot;********&quot;);                            
                      dlc.Endpoint.Behaviors.Add(behavior);
  
                      GetDistributionLists gdl = new GetDistributionLists();
  
                      gdl.PersonID = 0;
  
                      GetDistributionListsResponse gdlr = new GetDistributionListsResponse();
  
                      gdlr = dlc.GetDistributionLists(gdl);
                      return gdlr;
                  }
                  catch (Exception e)
                  {
                      dlc.Abort();
                      return null;
                  }
              }
  </code></pre>
  <p>My PasswordDigentInspector</p>
  <pre><code>public object BeforeSendRequest(ref System.ServiceModel.Channels.Message request, System.ServiceModel.IClientChannel channel)
          {
              // Use the WSE 3.0 security token class
              UsernameToken token = new UsernameToken(this.Username, this.Password, PasswordOption.SendPlainText);
              WseHeader header = new WseHeader(this.Username, this.Password);
  
              // Serialize the token to XML
              XmlElement securityToken = token.GetXml(new XmlDocument());           
  
              MessageHeader securityHeader = MessageHeader.CreateHeader(&quot;Security&quot;, &quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken&quot;, securityToken, false);
              request.Headers.Add(header);
  
              // complete
              return Convert.DBNull;
          }
  </code></pre>
  <p>How I apply client behavior</p>
  <pre><code>public void ApplyClientBehavior(ServiceEndpoint endpoint, System.ServiceModel.Dispatcher.ClientRuntime clientRuntime)
          {
              clientRuntime.MessageInspectors.Add(new PasswordDigestMessageInspector(this.Username, this.Password));
          }
  </code></pre>
  <p>Everything is pretty much there.  I am not seing where the body is being injected into the header.  Any body have any ideas?</p>
  <p><strong>UPDATE: Debugging</strong>
  I am looking at the the actual header that I inject into the soap message and this is what I see...</p>
  <pre><code>{&lt;wsse:Security s:mustUnderstand=&quot;0&quot; xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot; xmlns:s=&quot;http://schemas.xmlsoap.org/soap/envelope/&quot;&gt;
    &lt;UsernameToken xmlns=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot;&gt;
      &lt;Username&gt;**********&lt;/Username&gt;
      &lt;Password&gt;************&lt;/Password&gt;
    &lt;/UsernameToken&gt;} System.ServiceModel.Channels.MessageHeaderInfo {TestDistListApplication.Repository.WseHeader}
  </code></pre>
  <p>Just looking at that, there is no nonce, I could build it programmatically, but I am not sure if that is a good idea.  Especially since there is a nonce already and a create date in the securityToken... Not sure why they don't appear in the header though...</p>
  <pre><code>&lt;wsse:Username xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot;&gt;MedTrak_Dev&lt;/wsse:Username&gt;
  &lt;wsse:Password Type=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText&quot; xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot;&gt;uncJUN132012&lt;/wsse:Password&gt;
  &lt;wsse:Nonce xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot;&gt;mvy9nUfF+rnT3oTasDBqxg==&lt;/wsse:Nonce&gt;
  &lt;wsu:Created xmlns:wsu=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd&quot;&gt;2012-08-28T13:30:42Z&lt;/wsu:Created&gt;
  </code></pre>
  <p>I have the debugger stopped and I am watching both those variables.  What might cause the header not to have those things and the the WSEHeader to have them?
  Looks like I will have to debugg that.</p>