Edit

How to: Set Up a Signature Confirmation

  • Article

Signature confirmation is a mechanism for a message initiator to ensure that a received reply was generated in response to the sender's original message. Signature confirmation is defined in the WS-Security 1.1 specification. If an endpoint supports WS-Security 1.0, you cannot use signature confirmation.

The following procedures specify how to enable signature confirmation using an AsymmetricSecurityBindingElement. You can use the same procedure with a SymmetricSecurityBindingElement. The procedure builds upon the basic steps found in How to: Create a Custom Binding Using the SecurityBindingElement.

To enable signature confirmation in code

  1. Create an instance of the BindingElementCollection class.

  2. Create an instance of the SymmetricSecurityBindingElement class.

  3. Set the RequireSignatureConfirmation to true.

  4. Add the security element to the binding collection.

  5. Create a custom binding, as specified in How to: Create a Custom Binding Using the SecurityBindingElement.

To enable signature confirmation in configuration

  1. Add a <customBinding> element to the <bindings> section of the configuration file.

  2. Add a <binding> element and set the name attribute to an appropriate value.

  3. Add an appropriate encoding element. The following example adds a <TextMessageEncoding> element.

  4. Add a <security> child element and set the requireSignatureConfirmation attribute to true.

  5. Optional. To enable signature confirmation during the bootstrap, add a <secureConversationBootstrap> child element and set the requireSignatureConfirmation attribute to true.

  6. Add an appropriate transport element. The following example adds an <httpTransport>:

    <bindings>
  <customBinding>
    <binding name="SignatureConfirmationBinding">
      <security requireSignatureConfirmation="true">
        <secureConversationBootstrap requireSignatureConfirmation="true" />
          </security>
       <textMessageEncoding />
         <httpTransport />
    </binding>
  </customBinding>
</bindings>

Example

The following code creates an instance of the SymmetricSecurityBindingElement and sets the RequireSignatureConfirmation property to true. Note that this example does not use the <secureConversationBootstrap> element shown in the preceding example. This example demonstrates signature confirmation when using a Windows (Kerberos protocol) token. In this case, the signature of the client is returned in all responses from the service and is confirmed by the client.

private Binding CreateBinding()
{
    BindingElementCollection bindings = new BindingElementCollection();
    KerberosSecurityTokenParameters tokens = new KerberosSecurityTokenParameters();
    SymmetricSecurityBindingElement security =
      new SymmetricSecurityBindingElement(tokens);

    // Require that every request and return be correlated.
    security.RequireSignatureConfirmation = true;

    bindings.Add(security);
    TextMessageEncodingBindingElement encoding = new TextMessageEncodingBindingElement();
    bindings.Add(encoding );
    HttpTransportBindingElement transport = new HttpTransportBindingElement();
    bindings.Add(transport);
    CustomBinding myBinding = new CustomBinding(bindings);
    return myBinding;
}

Private Function CreateBinding() As Binding
    Dim bindings As New BindingElementCollection()
    Dim tokens As New KerberosSecurityTokenParameters()

    Dim security As New SymmetricSecurityBindingElement(tokens)

    ' Require that every request and return be correlated.
    security.RequireSignatureConfirmation = True

    bindings.Add(security)
    Dim encoding As New TextMessageEncodingBindingElement()
    bindings.Add(encoding)
    Dim transport As New HttpTransportBindingElement()
    bindings.Add(transport)
    Dim myBinding As New CustomBinding(bindings)
    Return myBinding
End Function

See also