I have an existing WCF REST service running on an Azure Windows Server 2012 using IIS8. Let say 1x.2x.3x.4x:7777/InvService.svc/RESTquery is how my users currently use the service.
I am wanting to replace the IP address with a hostname, say www.testDomain.com so the user will can then use www.testDomain.com:7777/InvService.svc/RESTquery.
After obtaining the domain name from GoDaddy, assigning IP 1x.2x.3x.4x, and testing it (my default site on the server comes up, hence why I am using port 7777). When I try www.testDomain.com:7777/InvService.svc/RESTquery I get a "Connection Timed Out" error.
I believe I am needing to add or change something inside my Web.config file but cannot seem to find the right answer. Here is what my current unsuccessful Web.config file looks like.
<services>
<service name="WCFInventoryService.InvService">
<endpoint address="RESTquery" behaviorConfiguration="restPoxBehavior"
binding="webHttpBinding" contract="WCFInventoryService.IInvService" />
<identity>
<dns value="www.testDomain.com" />
</identity>
</endpoint>
<host>
<baseAddresses>
<add baseAddress="http://www.testDomain.com/"/>
</baseAddresses>
</host>
</service>
</services>
What am I doing wrong? or should try?
I solved my problem. The problem was how the domain was set up in GoDaddy. In the GoDaddy account, the domain was set up to forward to the IP address and not to point to. Once I removed the forwarding record and changed the A record to point to the IP address in the GoDaddy account, the WCF service was accessible by using www.testDomain.com:7777/InvService.svc/RESTquery
Related
currently We have CAS SSO to our existing .net application, but now client is asking for Shibboleth SSO instead CAS. I'm totally new to Shibboleth.
Client has given the below details:
entityid= urn:mace:incommon:xxx.edu
metadata URL for test environment is:
https://shibboleth-test.xxx.edu/idp/shibboleth
By using guidelines from Shibboleth site, below are the steps i followed.
Installed Shibbolth Service provider (shibboleth-sp-2.6.1.4-win64.msi)
Installed Java with JCE
Installed Shibboleth Idp (in which jetty also checked)(shibboleth-identity-provider-3.3.3-x64.msi)
Web Application with self signed certificate
attached my Shibboleth2.xml file
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180"> <InProcess logger="native.logger"> <ISAPI normalizeRequest="true" safeHeaderNames="true">
<Site id="2" name="shibboleth-test.xxx.edu" scheme="https" port="443" />
</ISAPI> </InProcess> <RequestMapper type="Native"> <RequestMap> <Host name="shibboleth-test.xxx.edu" scheme="https" port="443">
<Path name="secure" authType="shibboleth" requireSession="true"/>
</Host>
</RequestMap></RequestMapper><ApplicationDefaults entityID="urn:mace:incommon:xxx.edu" REMOTE_USER="eppn persistent-id targeted-id" cipherSuites="ECDHE+AESGCM:ECDHE:!aNULL:!eNULL:!LOW:!EXPORT:!RC4:!SHA:!SSLv2"> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="true" cookieProps="https"> <SSO entityID=""urn:mace:incommon:xxx.edu" discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF"> SAML2 SAML1 </SSO>
<!-- SAML and local-only logout. -->
<Logout>SAML2 Local</Logout>
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
<!-- Status reporting service. -->
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1 <my system IP">/>
<!-- Session diagnostic service. -->
<Handler type="Session" Location="/Session" showAttributeValues="false"/>
<!-- JSON feed of discovery information. -->
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
</Sessions>
<Errors supportContact="root#localhost"
helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/> <!-- Map to extract attributes from SAML assertions. --> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
<AttributeResolver type="Query" subjectMatch="true"/> <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
</ApplicationDefaults>
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>
Problems I'm facing......
When i try to access https://shibboleth-test.xxx.edu/Shibboleth.sso/Status
getting error no metadataprovider available.
Noticed Problems:
1.when i try to add Metadataprovider Shibboleth daemon 2 service is getting
stopped and unable to start.if i remove it's is running.
2.Shibboleth Idp 3 deamon is getting stopped very frequently
When i run 'SC interrogate shibd_idp' in command prompt, results are
control service failed 1062
the service has not been started.
I donno what is wrong with my work.
Can any one please tell me what are the steps to be followed to accomplish this integration.
Thanks in advance,
Hema
There will be a tag in shibboleth2.xml called metadata provider, you will need to open that.
If you have done this but shill service is not getting started then you can check the log and give additional info in question.
Another reason I can think of is connection problem. Try downloading idP's metadata and store it physically in the SP configuration folder. Manually map the file, using following tag
<MetadataProvider type="XML" file="partner-metadata.xml"/>
All the issues has been resolved after we upgraded from Shibboleth 2.6 to 3.0.2. we are getting the Shibboleth Identity provider login page.We are able to see the attributes in Session.Now we are working on how to retrieve the attributes in our application and how to redirect to our application home page.Currently we created 1 sample html page under secure folder in our application. once we logged in we are able to this html page.But when i tried to redirect to our application home page, it's giving 500 error. Can any one knows like how to redirect to our app home page and retrieve the attributes in the application.
I have read through NWebSec's documentation to try and resolve the problem.
Set the web.config to
<nwebsec>
<httpHeaderSecurityModule
xsi:noNamespaceSchemaLocation="NWebsecConfig/HttpHeaderSecurityModuleConfig.xsd"
xmlns="http://nwebsec.com/HttpHeaderSecurityModuleConfig.xsd"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<redirectValidation enabled="false">
<allowSameHostRedirectsToHttps enabled="false"/>
<add allowedDestination="https://www.facebook.com/"/>
<add allowedDestination="http://www.nwebsec.com/"/>
<add allowedDestination="https://www.google.com/accounts/"/>
</redirectValidation>
<securityHttpHeaders>
<strict-Transport-Security max-age="365" includeSubdomains="true" httpsOnly="false" preload="true" />
</securityHttpHeaders>
</httpHeaderSecurityModule>
but I am still getting
A potentially dangerous redirect was detected. Add the destination to the whitelist in configuration if the redirect was intended. Offending redirect: https://www.facebook.com/dialog/oauth?response_type=code&
This came up in google before the answer, which is here: https://docs.nwebsec.com/en/latest/nwebsec/Redirect-validation.html
In summary you have to whitelist the URL which your login service refers to, like this:
app.UseRedirectValidation(opts =>
{
opts.AllowedDestinations( "https://www.facebook.com/dialog/oauth");
opts.AllowedDestinations("https://login.microsoftonline.com"); // Tested
});
I'm developing an ios app which will invoke a web service operation. The existing web service is configured with wsHttpBinding security set as TransportWithMessageCredential.
I've used wsdl2objc to generate the implementation files (from wsdl) and have setup a small app for testing purposes. I'm not able to get the app to talk to the web service correctly though, and from what I've read it seems virtually impossible with these web config settings (wsHttpBinding, Transport and Message security).
I've done quite a bit of research, and with the help of information found on this site (and others), I've managed to find out what SOAP requests should look like. I basically used WCF Test Client with Fiddler monitoring the traffic. I also tried soapUI, which wasn't as successful as I'd hoped.
I did setup a test web service locally and I can successfully consume, but only when the web config has security using BasicHttpBinding or wsHttpBinding security mode = "none" (which I understand is just like basicHttpBinding).
My solution (I hope) is...what if I write a web service to call this web service? Both web services will reside on the server, but the one the iphone will consume is configured with SSL. The idea is then to manually encrypt the operation (and necessary attributes) using an ios security framework (HMAC) or other hashing algorythm, and have the SSL web service decrypt and then invoke the requested operation from the existing web service. Does this make sense? I'm thinking this seems too simple, that I must be missing something. Does anyone see any real problem with this?
Thanks.
Edit I just wanted to clarify my situation a little: My app is not able to consume the existing web service as it is configured. My thought was to create a web service which will talk with this one. The new web service will simply decrypt the incoming data and invoke a method on the existing web service. Once a response is received, the new web service will encrypt the data and send it back to the iphone app. Sorry if I'm not being clear.
Update
Here is the soap envelope (from Fiddler):
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action s:mustUnderstand="1">http://tempuri.org/IService/ValidateMe</a:Action>
<a:MessageID>urn:uuid:81d70393-5356-4e3a-b209-49ea53068935</a:MessageID>
<a:ReplyTo>
<a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1">https://mibe.stpa.com/WCFService/IVService.svc/ValidationService</a:To>
<o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1">
<u:Timestamp u:Id="_0">
<u:Created>2013-02-10T04:48:18.646Z</u:Created>
<u:Expires>2013-02-10T04:53:18.646Z</u:Expires>
</u:Timestamp>
<c:SecurityContextToken xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc" u:Id="uuid-0191ec20-905d-4ef0-a818-3eced0e02ecf-32">
<c:Identifier>urn:uuid:06bd1d3e-97e5-41bc-afce-3993736f202d</c:Identifier>
</c:SecurityContextToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1"/>
<Reference URI="#_0">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>/RpEprwYbnSypHXVF/rdxn3nkRo=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>ya8hHooO129dNOHplhY3xRndoDk=</SignatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<o:Reference ValueType="http://schemas.xmlsoap.org/ws/2005/02/sc/sct" URI="#uuid-0191ec20-905d-4ef0-a818-3eced0e02ecf-32"/>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
</s:Header>
<s:Body>
<ValidateMe xmlns="http://tempuri.org/">
<memberId>950470173</memberId>
</ValidateMe>
</s:Body>
</s:Envelope>
I have recently upgraded our Azure solution to use the new 1.7 SDK. CSPack warned that it was running on a legacy syntax and required a definition in the service definition to run under full IIS. Here's what I added.
<Sites>
<Site name="Web" physicalDirectory="..\Portal\MyApp.Portal">
<Bindings>
<Binding name="HttpIn" endpointName="HttpIn" />
</Bindings>
</Site>
</Sites>
The web role is an MVC3 application with the following mail settings defined in web.config.
<system.net>
<mailSettings>
<smtp deliveryMethod="Network">
<network host="smtp.gmail.com" userName="support#myapp.com" enableSsl="true" port="587" password="mypassword"/>
</smtp>
</mailSettings>
These settings are pulled fine from web.config for sending emails from code by just declaring a SMTP client and using it to send emails,
SmtpClient client = new SmtpClient();
But when I add the section to the service definition the setting are not used and I get a SMTP host was not specified every time an email is attempted. The new SmtpClient() has none of the settings from config. I can not figure out how to fix this nor can I find any info elsewhere.
Try changing the name of your site to anything other than "Web".
There's a poorly documented feature of this syntax that a site with the name of "Web" will have all of it's settings like physicalDirectory ignored. If this works it might pay to think about whether or not you actually need the physicalDirectory specified.
I am consuming an secured service hosted over basicHttpBinding
I have to pass credentials to the service for authenticatioon
Here’s the config setting for the client
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="None" proxyCredentialType="None"
realm="" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
While calling the service, I am getting following exception message
An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail.
Message = "An invalid security token was provided (Bad UsernameToken Values)”
I not sure how to get it working I am curious if somebody can help me out or provide me any url where I could find the solution
When you create your MyServiceClient object you can set the username and password on the clientInstance.Credentials.UserName object.