title: WCF Client with WS-Security
body: <p>I need to implement a WCF client that meets the following SOAP message example:</p>
  
  <pre><code>&lt;soapenv:Envelope
  xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
  xmlns:msa="http://msa.ebs.health.ontario.ca/"
  xmlns:idp="http://idp.ebs.health.ontario.ca/"
  xmlns:edt="http://edt.health.ontario.ca/"
  xmlns:ebs="http://ebs.health.ontario.ca/"&gt;
    &lt;soapenv:Header&gt;
      &lt;ns2:EBS wsu:Id="id-1" xmlns:ns2="http://ebs.health.ontario.ca/" &gt;
        &lt;SoftwareConformanceKey&gt;444561ee-277f-77b2-c664-7a9923jfgh1b&lt;/SoftwareConformanceKey&gt;
        &lt;AuditId&gt;f68e6ff9-74f7-4022-8618-ec2cf0ee4b6a&lt;/AuditId&gt;
      &lt;/ns2:EBS&gt;
      &lt;ns2:MSA wsu:Id="id-2" xmlns:ns2="http://msa.ebs.health.ontario.ca/" &gt;
        &lt;ServiceUserMUID&gt;4523394&lt;/ServiceUserMUID&gt;
        &lt;UserID&gt;johndoe&lt;/UserID&gt;
      &lt;/ns2:MSA&gt;
      &lt;wsse:Security SOAP-ENV:mustUnderstand="1"&gt;
        &lt;wsu:Timestamp wsu:Id="id-3"&gt;
          &lt;wsu:Created&gt;2012-06-26T16:18:15.185Z&lt;/wsu:Created&gt;
          &lt;wsu:Expires&gt;2012-06-26T16:18:45.185Z&lt;/wsu:Expires&gt;
        &lt;/wsu:Timestamp&gt;
        &lt;wsse:UsernameToken wsu:Id="id-4"&gt;
          &lt;wsse:Username&gt;72214255&lt;/wsse:Username&gt;
        &lt;/wsse:UsernameToken&gt;
        &lt;wsse:BinarySecurityToken
        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
        wsu:Id="X509-0EE1C2718CEDCA9FC213407274954261"&gt;
          MIICMzCCAZygAwIBAgIET1e+dDANBgkqhkiG9w0BAQUFADBeMQswCQYDVQQGEwJDQTEQMA4GA1UECBMHT250YXJpbzENMAsGA1UEChMET0hJUDEVMBMGA1UECxMMUmVnaXN0cmF0aW9uMRcwFQYDVQQDEw4xNDIuMTQ1LjcwLjE3NzAeFw0xMjAzMDcyMDAwNTJaFw0xMzAzMDcyMDAwNTJaMF4xCzAJBgNVBAYTAkNBMRAwDgYDVQQIEwdPbnRhcmlvMQ0wCwYDVQQKEwRPSElQMRUwEwYDVQQLEwxSZWdpc3RyYXRpb24xFzAVBgNVBAMTDjE0Mi4xNDUuNzAuMTc3MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCs/JIP6CE5IkfTnD/c56K+QAYqETdLvW1xXJ6ipkVhjjC2ASKuuH4fvhbyxo2B4VugsL9r4E5jHEKoi+GDKOLlLZRfSy0cB8IcpXonAuGqMzhCoEQ1CdxNb9etMyvQGRKEBgniKKxTvpTyZdpYDi92up5E+FYL3jEejhp+1iDFJQIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHn8VZS169BJMa4E6SNLnY7u80zSh90mbrTUWjM1dEicv3jQMMsrWHfoCt+nRSqfNLUTLc8U0LqiB3jnnNJgJt1T7Sp8eUZPdH0gY3i83ZXA8HDFKMZF3qL8I8ncu8FPcZGYBNhYrGjXXsuqXimiTIjxgm06ErRa/51szOFFxWrB
        &lt;/wsse:BinarySecurityToken&gt;
        &lt;ds:Signature Id="SIG-6" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" &gt;
          &lt;ds:SignedInfo&gt;
            &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
              &lt;ec:InclusiveNamespaces PrefixList="SOAP-ENV ebs soap-sec soapenv sp tns wsdl wsp wsse wsu xs xsi"
              xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
            &lt;/ds:CanonicalizationMethod&gt;
            &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
            &lt;ds:Reference URI="#id-1"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                  &lt;ec:InclusiveNamespaces
                  PrefixList="SOAP-ENV ebs soap-sec soapenv sp tns wsdl wsp wsse wsu xs xsi"
                  xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                &lt;/ds:Transform&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
              &lt;ds:DigestValue&gt;FkhA37COGmsKeEH50LAGhKntvRpD0+xOGsGzXAV210k=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
            &lt;ds:Reference URI="#id-2"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                  &lt;ec:InclusiveNamespaces
                  PrefixList="SOAP-ENV ebs soap-sec soapenv sp tns wsdl wsp wsse wsu xs xsi"
                  xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                &lt;/ds:Transform&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
              &lt;ds:DigestValue&gt;RA1O1voUNDV9+hi6IzNNxkTHfEdu2pu6fppiwN23JGI=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
            &lt;ds:Reference URI="#id-3"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                  &lt;ec:InclusiveNamespaces PrefixList="SOAP-ENV ebs soap-sec soapenv sp tns wsdl wsp wsse xs xsi"
                  xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                &lt;/ds:Transform&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
              &lt;ds:DigestValue&gt;3vVj2VEbLKEvGy4yt7k8i2BeWUOaCygnFMduT7EyP3A=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
            &lt;ds:Reference URI="#id-4"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                  &lt;ec:InclusiveNamespaces PrefixList="SOAP-ENV ebs soap-sec soapenv sp tns wsdl wsp wsu xs xsi"
                  xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                &lt;/ds:Transform&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
              &lt;ds:DigestValue&gt;yFOmFgMDHMBooWIEsB3azib2EX7fR+Ich03J19kFMVE=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
            &lt;ds:Reference URI="#id-5"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                  &lt;ec:InclusiveNamespaces PrefixList="SOAP-ENV ebs soap-sec sp tns wsdl wsp wsse wsu xs xsi"
                  xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                &lt;/ds:Transform&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
              &lt;ds:DigestValue&gt;zoxMcAQ2WLBIir333NJk52r4axwznflX+KxMQTPFvfQ=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;
            HmOiZS4gZbxv07+sLjyi7Vfg3Rfpvr3IVnaHfRp4aKvg5yBFlLocPIYwhUhmCCs1LXrJxR0hsbe0K2sz3ML5hH+PDEGetlPKSN9R1x9K95w7V1JQcTUULiVgNGLCfxgFV2HNy1iNvlTc7COS+7w4xSgsY4KlVgrBw0T1srhHpUA=
          &lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo Id="KI-0EE1C2718CEDCA9FC213407274954662"&gt;
            &lt;wsse:SecurityTokenReference wsu:Id="STR-0EE1C2718CEDCA9FC213407274954663"&gt;
              &lt;wsse:Reference URI="#X509-0EE1C2718CEDCA9FC213407274954261"
              ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" /&gt;
            &lt;/wsse:SecurityTokenReference&gt;
          &lt;/ds:KeyInfo&gt;
        &lt;/ds:Signature&gt;
      &lt;/wsse:Security&gt;
    &lt;/soapenv:Header&gt;
    &lt;soapenv:Body wsu:Id="id-5"
    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
      &lt;edt:upload&gt;
        &lt;upload&gt;
          &lt;content&gt;
            &lt;inc:Include href="cid:2341682853256" xmlns:inc="http://www.w3.org/2004/08/xop/include" /&gt;
          &lt;/content&gt;
          &lt;description&gt;00123&lt;/description&gt;
          &lt;resourceType&gt;CL&lt;/resourceType&gt;
        &lt;/upload&gt;
      &lt;/edt:upload&gt;
    &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>The most similar I've gotten has been with the following binding configuration and custom binding alteration to include the UserNameSecurityTokenParameter: </p>
  
  <pre><code>&lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="EDTDelegate"
                   closeTimeout="00:01:00"
                   openTimeout="00:01:00"
                   receiveTimeout="00:10:00"
                   sendTimeout="00:10:00"
                   allowCookies="false"
                   bypassProxyOnLocal="false"
                   hostNameComparisonMode="StrongWildcard"
                   maxBufferPoolSize="524288"
                   maxReceivedMessageSize="655360"
                   messageEncoding="Mtom"
                   textEncoding="utf-8"
                   useDefaultWebProxy="true"&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;transport clientCredentialType="Basic" proxyCredentialType="None" realm=""/&gt;
              &lt;message clientCredentialType="Certificate" algorithmSuite="Default" establishSecurityContext="false" negotiateServiceCredential="false" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
  </code></pre>
  
  <p>This is the code I'm using to add the UsnerNameSupportingToken:
  </p>
  
  <pre><code>public static Binding AddUserNameSupportingTokenToBinding( Binding binding )
  {
      var elements = binding.CreateBindingElements( );
      var security = elements.Find&lt;SecurityBindingElement&gt;( );
      if ( security != null )
      {
         var tokenParameters = new UserNameSecurityTokenParameters( );
         tokenParameters.InclusionMode = SecurityTokenInclusionMode.AlwaysToRecipient;
         tokenParameters.RequireDerivedKeys = false;
         security.EndpointSupportingTokenParameters.SignedEncrypted.Add( tokenParameters );
  
         return new CustomBinding( CollectionUtils.GetArray&lt;BindingElement&gt;( elements ) ); 
      }
  
    throw new ArgumentException( "Binding contains no SecurityBindingElement" );
  }
  </code></pre>
  
  <p>However, it is unable to connect and or get another response from the server than an internal server error (I assume due to not compliance of the message with the one expected by the server)</p>
  
  <p>This is the message I'm sending.</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
    &lt;s:Header&gt;
      &lt;a:Action s:mustUnderstand="1"&gt;http://edt.health.ontario.ca/EDTDelegate/uploadRequest&lt;/a:Action&gt;
      &lt;h:EBS xmlns:h="http://ebs.health.ontario.ca/" xmlns="http://ebs.health.ontario.ca/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
        &lt;SoftwareConformanceKey xmlns=""&gt;444361ee-277f-7732-c684-7a9923jfgh1b&lt;/SoftwareConformanceKey&gt;
        &lt;AuditId xmlns=""&gt;124355467675&lt;/AuditId&gt;
      &lt;/h:EBS&gt;
      &lt;h:IDP xmlns:h="http://idp.ebs.health.ontario.ca/" xmlns="http://idp.ebs.health.ontario.ca/"&gt;
        &lt;ServiceUserMUID xmlns=""&gt;1111222&lt;/ServiceUserMUID&gt;
      &lt;/h:IDP&gt;
      &lt;h:MSA xmlns:h="http://msa.ebs.health.ontario.ca/" xmlns="http://msa.ebs.health.ontario.ca/"&gt;
        &lt;ServiceUserMUID xmlns=""&gt;1111222&lt;/ServiceUserMUID&gt;
        &lt;UserID xmlns=""&gt;johndoe@examplemail.com&lt;/UserID&gt;
      &lt;/h:MSA&gt;
      &lt;a:MessageID&gt;urn:uuid:5e622e7a-ec98-4ee3-b7c8-1cfaec188136&lt;/a:MessageID&gt;
      &lt;a:ReplyTo&gt;
        &lt;a:Address&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
      &lt;/a:ReplyTo&gt;
      &lt;VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink"&gt;uIDPo86225XKzvdDstW/QNIEkkkAAAAAUbXx6AYITkSuseKiCyJ3EndgEcfrnxtMkRLZu91buJMACQAA&lt;/VsDebuggerCausalityData&gt;
      &lt;To a:mustUnderstand="1" u:Id="_1" xmlns="http://www.w3.org/2005/08/addressing" xmlns:a="http://www.w3.org/2003/05/soap-envelope"&gt;https://ws.ebs.health.gov.on.ca:1441/EDTService/EDTService&lt;/To&gt;
      &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
        &lt;u:Timestamp u:Id="_0"&gt;
          &lt;u:Created&gt;2013-10-07T14:47:11.687Z&lt;/u:Created&gt;
          &lt;u:Expires&gt;2013-10-07T14:52:11.687Z&lt;/u:Expires&gt;
        &lt;/u:Timestamp&gt;
        &lt;o:UsernameToken u:Id="uuid-5ee937ee-c1c6-404c-a827-1ca0ee22cfe1-1"&gt;
          &lt;o:Username&gt;johndoe@examplemail.com&lt;/o:Username&gt;
          &lt;o:Password o:Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;54321&lt;/o:Password&gt;
        &lt;/o:UsernameToken&gt;
        &lt;o:BinarySecurityToken u:Id="uuid-5ee937ee-c1c6-404c-a827-1ca0ee22cfe1-2" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;MIIB0TCCATqgAwIBAgIQZSTkN52mXZFGuZfVCPPu4TANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwHhcNMTMwMTA0MTcwMTQxWhcNMTgwMTA0MDAwMDAwWjAUMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN+FQSfgZuCELM+dfMLM+JUecV9313wmgFRMKVWHlgGml/9QrSCXmSoiiTZl+5n7DLmjTnB7RbrAu/rva6KPPulN5QOBrYQDvea0Iw0eUXsZw2DYKGMpeCOnZI73g4LXSTq7MsOUc+6U579Sca0clPjXTJwZ/wO0E1aq/x5OJjhDAgMBAAGjJDAiMAsGA1UdDwQEAwIEsDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOBgQAVxQTfRI26bqJthHgETMLPmtMPaUwRQEcy7Kn1GQdPKXBaSHbN8iUkUoUBRvWCBVd+PilCgNXPMyK52WZJEqGyNdBzVR9oXa1sYWeXm3Nic0Qp2uZ7cMA5t/TLLdb7L03QdJ2OWtaPc29yClquas5OOTQtDBL79Nzm+/z45M12DQ==&lt;/o:BinarySecurityToken&gt;
        &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;SignedInfo&gt;
            &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
            &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
            &lt;Reference URI="#_0"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
              &lt;DigestValue&gt;nJu/wqr3l9c+bsczWgNkoqR9orc=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#_1"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
              &lt;DigestValue&gt;YwVphhmJ70apQiykWlMqZ7dv2S4=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
          &lt;SignatureValue&gt;BpulyIHAVry9TW8T2mZvPv9yP8FEGa21UdedB3KZWo7xQ4fbYrewAuOkacm2NN2q+a9jlc5iHRIQ9Ktdb0EieHzXQne2PNiIl2E1QXT5NG/MDAfnczvkXxbG2hrCdP0ZXbMIwtA2znv0u1/UwrFEjm5ILqUd+wgTlqDaEpgCpBU=&lt;/SignatureValue&gt;
          &lt;KeyInfo&gt;
            &lt;o:SecurityTokenReference&gt;
              &lt;o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-5ee937ee-c1c6-404c-a827-1ca0ee22cfe1-2"/&gt;
            &lt;/o:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
        &lt;/Signature&gt;
      &lt;/o:Security&gt;
    &lt;/s:Header&gt;
    &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;upload xmlns="http://edt.health.ontario.ca/"&gt;
        &lt;upload xmlns=""&gt;
          &lt;content&gt;
            &lt;xop:Include href="cid:http%3A%2F%2Ftempuri.org%2F1%2F635167396385870396" xmlns:xop="http://www.w3.org/2004/08/xop/include"/&gt;
          &lt;/content&gt;
          &lt;description&gt;C:\CL\1\HI155614.018&lt;/description&gt;
          &lt;resourceType&gt;CL&lt;/resourceType&gt;
        &lt;/upload&gt;
      &lt;/upload&gt;
    &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>Could somebody please tell me what I'm doing wrong? The first thing I've seen is that I have only 2 Reference sections in the Signature/SignedInfo while in the example there are 5. :-S   Please help !!! Thanks in advance.</p>