You can configure a Microsoft WCF/.NET 4.5 web service to implement message transmission optimization mechanism for interoperability with an OWSM 14c client.

To configure the Microsoft WCF/.NET 4.5 web service:

1. Create a .NET web service.

   For an example, see the following .NET web service for MTOM interoperability sample:

   static void Main(string[] args)
   {
       string uri = "http://host:port/TEST/MTOMService/SOA/MTOMService";
       // Step 1 of the address configuration procedure: Create a URI to serve as the base address.
       Uri baseAddress = new Uri(uri);
   
       // Step 2 of the hosting procedure: Create ServiceHost
       ServiceHost selfHost = new ServiceHost(typeof(MTOMService), baseAddress);
    
       try {
           HttpTransportBindingElement hb = new HttpTransportBindingElement();
           hb.ManualAddressing = false;
           hb.MaxBufferPoolSize = 2147483647;               
           hb.MaxReceivedMessageSize = 2147483647;
           hb.AllowCookies = false;
           hb.AuthenticationScheme = System.Net.AuthenticationSchemes.Anonymous;
           hb.KeepAliveEnabled = true;
           hb.MaxBufferSize = 2147483647;
           hb.ProxyAuthenticationScheme = System.Net.AuthenticationSchemes.Anonymous;
           hb.Realm = "";
           hb.TransferMode = System.ServiceModel.TransferMode.Buffered;
           hb.UnsafeConnectionNtlmAuthentication = false;
           hb.UseDefaultWebProxy = true;
           MtomMessageEncodingBindingElement me = new MtomMessageEncodingBindingElement();
           me.MaxReadPoolSize=64;
           me.MaxWritePoolSize=16;
           me.MessageVersion=System.ServiceModel.Channels.MessageVersion.Soap12;
           me.WriteEncoding = System.Text.Encoding.UTF8;
           me.MaxWritePoolSize = 2147483647;
           me.MaxBufferSize = 2147483647;
           me.ReaderQuotas.MaxArrayLength = 2147483647;
           CustomBinding binding1 = new CustomBinding();
           binding1.Elements.Add(me);
           binding1.Elements.Add(hb);
           ServiceEndpoint ep = selfHost.AddServiceEndpoint(typeof(IMTOMService), binding1, 
                  "MTOMService");
           EndpointAddress myEndpointAdd = new EndpointAddress(new Uri(uri),
           EndpointIdentity.CreateDnsIdentity("WSMCert3"));               
           ep.Address = myEndpointAdd;
   
           // Step 4 of the hosting procedure: Enable metadata exchange.
           ServiceMetadataBehavior smb = new ServiceMetadataBehavior();
           smb.HttpGetEnabled = true;
           selfHost.Description.Behaviors.Add(smb);
           using (ServiceHost host = new ServiceHost(typeof(MTOMService)))
           {
               System.ServiceModel.Description.ServiceDescription svcDesc = 
                    selfHost.Description;
               ServiceDebugBehavior svcDebug = 
                     svcDesc.Behaviors.Find<ServiceDebugBehavior>();
               svcDebug.IncludeExceptionDetailInFaults = true;
           }
    
           // Step 5 of the hosting procedure: Start (and then stop) the service.
           selfHost.Open();
           Console.WriteLine("The service " + uri + " is ready.");
           Console.WriteLine("Press <ENTER> to terminate service.");
           Console.WriteLine();
           Console.ReadLine();
           // Close the ServiceHostBase to shutdown the service.
           selfHost.Close();
       }
       catch (CommunicationException ce)
       {
           Console.WriteLine("An exception occurred: {0}", ce.Message);
           selfHost.Abort();
       }
   }

   For more information, see "How to: Define a Windows Communication Foundation Service Contract" at http://msdn.microsoft.com/en-us/library/ms731835.aspx.

2. Deploy the application.

You can configure an OWSM 14c client to implement message transmission optimization mechanism for interoperability with a Microsoft WCF/.NET 4.5 web service.

To configure an OWSM 14c client:

1. Using JDeveloper, create a SOA composite that consumes the .NET web service.

   For more information, see Developer's Guide for SOA Suite.

2. Attach the following policy to the web service client: oracle/wsmtom_policy.

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

You can configure an OWSM 14c web service to implement username token with message protection for interoperability with a Microsoft WCF/.NET 4.5 client.

To configure the OWSM 14c web service:

1. Create a SOAP 1.2 compliant web service application.

2. Select the policy to use based on whether or not you want to enable secure conversation:

   1. If you do not want to enable secure conversation, clone either of the following policies:

      oracle/wss11_saml_or_username_token_with_message_protection_service_policy

      oracle/wss11_username_token_with_message_protection_service_policy

      Note:

      In the case of secure conversation not enabled, you will have to set the establishSecurityContext property to false for the client, as described in "Configuring Microsoft WCF/.NET 4.5 Client (Username Token with Message Protection)".

   2. To enable secure conversation, clone the following policy:

      oracle/wss11_username_token_with_message_protection_wssc_service_policy

   For more information, see "Cloning a Web Service Policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

3. Edit the policy configuration settings of the cloned policy from step 2, above, as follows:

   1. Enable the X509 Token Derived Keys configuration setting.

   2. Enable the Encrypt Signature configuration setting.

   3. Disable the Confirm Signature configuration setting.

   4. Leave the default configuration set for all other configuration settings.

   Attach the policy to the web service. For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

4. Also attach the following policy:

   oracle/wsaddr_policy

5. Export the X.509 certificate file from the keystore on the service side to a .cer file (for example, alice.cer) using the following command:

   keytool -export -alias alice -file C:\alice.cer -keystore default-keystore.jks
   

   For more information, see "keytool - Key and Certificate Management Tool" at http://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html.

You can configure a Microsoft WCF/.NET 4.5 client to implement username token with message protection for interoperability with an OWSM 14c web service.

To configure the Microsoft WCF/.NET 4.5 client:

1. Import the certificate file (exported previously) to the keystore on the client server using Microsoft Management Console (mmc), as follows:

   1. Open a command prompt.

   2. Type mmc and press Enter.

   3. Select File > Add/Remove snap-in.

   4. Select Add and Choose Certificates.

      Note:

      To view certificates in the local machine store, you must be in the Administrator role.

   5. Select Add.

   6. Select My user account and finish.

   7. Click OK.

   8. Expand Console Root > Certificates -Current user > Personal > Certificates.

   9. Right-click on Certificates and select All tasks > Import to launch Certificate import Wizard.

   10. Click Next, select Browse, and navigate to the .cer file that was exported previously.

   11. Click Next and accept defaults and finish the wizard.

   For more information, see "How to: View Certificates with the MMC Snap-in" at http://msdn.microsoft.com/en-us/library/ms788967.aspx.

2. Generate a .NET client using the WSDL of the web service.

   Note:

   You may have to set WS-Addressing action headers to prevent the client from sending implicit wsa:Action headers, as described in "Implicitly Associating WS-Addressing Action Properties" in Developing JAX-WS Web Services for Oracle WebLogic Server.

   For more information, see "How to: Create a Windows Communication Foundation Client" at http://msdn.microsoft.com/en-us/library/ms733133(v=vs.110).aspx

3. Edit the app.config file in the .NET project to update the certificate file and disable replays, as shown in the following sample (Changes are identified in bold). If you follow the default key setup, then <certificate_cn> should be set to alice.

   <?xml version="1.0" encoding="utf-8"?>
   <configuration>
     <system.serviceModel>
       <behaviors>
         <endpointBehaviors>
            <behavior name="secureBehaviour">
              <clientCredentials>
                <serviceCertificate>
                  <defaultCertificate findValue="<certificate_cn>" 
                   storeLocation="CurrentUser" storeName="My" 
                   x509FindType="FindBySubjectName"/>
                </serviceCertificate>
              </clientCredentials>
            </behavior>
         </endpointBehaviors>
       </behaviors>
       <bindings>
         <ws2007HttpBinding>
           <binding name="Wss11UsernameTokenWithMessageProtectionWSSCServicePortBinding" >
             <security mode="Message">
               <message clientCredentialType="UserName"
                   negotiateServiceCredential="false" 
                   algorithmSuite="Basic128"
                   establishSecurityContext="true" />
                   <!-- extablishSecurityContext is true by default and therefore does not 
                   have to be specified to enable secure conversation.
                   Set establishSecurityContext to false if secure conversation is not enabled -->
             </security>
           </binding>
         </ws2007HttpBinding>
       </bindings>
     <client>
       <endpoint address="http://10.244.167.70:7003/OWSMTestApp-Project1-context-root/ws11_username_token_with_message_protection_wsscPort?wsdl" 
           behaviorConfiguration="PMCert"
           binding="ws2007HttpBinding" 
           bindingConfiguration="Wss11UsernameTokenWithMessageProtectionWSSCServicePortBinding"   
           contract="ServiceReference1.ws11_username_token_with_message_protection_wssc" 
           name="ws11_username_token_with_message_protection_wsscPort">
         <identity>
           <dns value="orakey" />
         </identity>
       </endpoint>
     </client>
     </system.serviceModel>
   </configuration>

4. The establishSecurityContext property in the app.config file must be set according to whether you are enabling secure conversation.

   By default, establishSecurityContext is set to true, enabling secure conversation. If you are not enabling secure conversation, set establishSecurityContext to false.

   For example, see the sample (lines in bold italic).

5. Compile the project.

6. Open a command prompt and navigate to the project's Debug folder.

7. Enter <client_project_name>.exe and press Enter.

You can configure a Microsoft WCF/.NET 4.5 web service to implement username token with message protection for interoperability with an OWSM 14c client.

To configure the Microsoft WCF/.NET 4.5 web service:

1. Create a .NET web service.

   1. Create a custom binding for the web service using the SymmetricSecurityBindingElement, as shown in the following .NET web service sample. This example shows a web service without secure conversation enabled.

      static void Main(string[] args)
      {
          // Step 1 of the address configuration procedure: Create a URI to serve as the 
          // base address.        
          // Step 2 of the hosting procedure: Create ServiceHost
          string uri = "http://host:port/TEST/NetService";
          Uri baseAddress = new Uri(uri);
       
          ServiceHost selfHost = new ServiceHost(typeof(CalculatorService), baseAddress);
       
          try
          {
              SymmetricSecurityBindingElement sm = 
                  SymmetricSecurityBindingElement.CreateUserNameForCertificateBindingElement();
              sm.DefaultAlgorithmSuite = System.ServiceModel.Security.SecurityAlgorithmSuite.Basic128;
              sm.SetKeyDerivation(false);
              sm.SecurityHeaderLayout = SecurityHeaderLayout.Lax;
              sm.IncludeTimestamp = true;
              sm.KeyEntropyMode = SecurityKeyEntropyMode.CombinedEntropy;
              sm.MessageSecurityVersion = 
              MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005
              WSSecurityPolicy11BasicSecurityProfile10;
              sm.LocalClientSettings.CacheCookies = true;
              sm.LocalClientSettings.DetectReplays = true;
              sm.LocalClientSettings.ReplayCacheSize = 900000;
              sm.LocalClientSettings.MaxClockSkew = new TimeSpan(00, 05, 00);
              sm.LocalClientSettings.MaxCookieCachingTime = TimeSpan.MaxValue;
              sm.LocalClientSettings.ReplayWindow = new TimeSpan(00, 05, 00); ;
              sm.LocalClientSettings.SessionKeyRenewalInterval = new TimeSpan(10, 00, 00);
              sm.LocalClientSettings.SessionKeyRolloverInterval = new TimeSpan(00, 05, 00); ;
              sm.LocalClientSettings.ReconnectTransportOnFailure = true;
              sm.LocalClientSettings.TimestampValidityDuration = new TimeSpan(00, 05, 00); ;
              sm.LocalClientSettings.CookieRenewalThresholdPercentage = 60;
              sm.LocalServiceSettings.DetectReplays = false;
              sm.LocalServiceSettings.IssuedCookieLifetime = new TimeSpan(10, 00, 00);
              sm.LocalServiceSettings.MaxStatefulNegotiations = 128;
              sm.LocalServiceSettings.ReplayCacheSize = 900000;
              sm.LocalServiceSettings.MaxClockSkew = new TimeSpan(00, 05, 00);
              sm.LocalServiceSettings.NegotiationTimeout = new TimeSpan(00, 01, 00);
              sm.LocalServiceSettings.ReplayWindow = new TimeSpan(00, 05, 00);
              sm.LocalServiceSettings.InactivityTimeout = new TimeSpan(00, 02, 00);
              sm.LocalServiceSettings.SessionKeyRenewalInterval = new TimeSpan(15, 00, 00);
              sm.LocalServiceSettings.SessionKeyRolloverInterval = new TimeSpan(00, 05, 00);
              sm.LocalServiceSettings.ReconnectTransportOnFailure = true;
              sm.LocalServiceSettings.MaxPendingSessions = 128;
              sm.LocalServiceSettings.MaxCachedCookies = 1000;
              sm.LocalServiceSettings.TimestampValidityDuration = new TimeSpan(15, 00, 00);
              HttpTransportBindingElement hb = new HttpTransportBindingElement();
              hb.ManualAddressing = false;
              hb.MaxBufferPoolSize = 524288;
              hb.MaxReceivedMessageSize = 65536;
              hb.AllowCookies = false;
              hb.AuthenticationScheme = System.Net.AuthenticationSchemes.Anonymous;
              hb.KeepAliveEnabled = true;
              hb.MaxBufferSize = 65536;
              hb.ProxyAuthenticationScheme = System.Net.AuthenticationSchemes.Anonymous;
              hb.Realm = "";
              hb.TransferMode = System.ServiceModel.TransferMode.Buffered;
              hb.UnsafeConnectionNtlmAuthentication = false;
              hb.UseDefaultWebProxy = true;
              TextMessageEncodingBindingElement tb1 = new TextMessageEncodingBindingElement();
              tb1.MaxReadPoolSize = 64;
              tb1.MaxWritePoolSize = 16;
              tb1.MessageVersion = System.ServiceModel.Channels.MessageVersion.Soap12;
              tb1.WriteEncoding = System.Text.Encoding.UTF8;
              CustomBinding binding1 = new CustomBinding(sm);
              binding1.Elements.Add(tb1);
              binding1.Elements.Add(hb);
              ServiceEndpoint ep = selfHost.AddServiceEndpoint(typeof(ICalculator), binding1,
                "CalculatorService");
       
              EndpointAddress myEndpointAdd = new EndpointAddress(                    
              new Uri(uri),
              EndpointIdentity.CreateDnsIdentity("WSMCert3"));
              ep.Address = myEndpointAdd;
       
              // Step 4 of the hosting procedure: Enable metadata exchange.
              ServiceMetadataBehavior smb = new ServiceMetadataBehavior();
              smb.HttpGetEnabled = true;
              selfHost.Description.Behaviors.Add(smb);
              selfHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.CurrentUser, 
                 StoreName.My,
              X509FindType.FindBySubjectName, "WSMCert3");
              selfHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode =
                  X509CertificateValidationMode.PeerOrChainTrust;
              selfHost.Credentials.UserNameAuthentication.UserNamePasswordValidationMode =
                  UserNamePasswordValidationMode.Custom;
              CustomUserNameValidator cu = new CustomUserNameValidator();
              selfHost.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = cu;
              using (ServiceHost host = new ServiceHost(typeof(CalculatorService)))
              {
                  System.ServiceModel.Description.ServiceDescription svcDesc = selfHost.Description;
                  ServiceDebugBehavior svcDebug = svcDesc.Behaviors.Find<ServiceDebugBehavior>();
                  svcDebug.IncludeExceptionDetailInFaults = true;
              }
       
              // Step 5 of the hosting procedure: Start (and then stop) the service.
              selfHost.Open();
              Console.WriteLine("The Calculator service is ready.");
              Console.WriteLine("Press <ENTER> to terminate service.");
              Console.WriteLine();
              Console.ReadLine();
              selfHost.Close();
          }
          catch (CommunicationException ce)
          {
               Console.WriteLine("An exception occurred: {0}", ce.Message);
               selfHost.Abort();
           }
      }
      

   To enable secure conversation, make the following adjustments to the code in the example:

   1. Create another SymmetricSecurityBindingElement element based on the one created (sm), for example:

      SymmetricSecurityBindingElement scsm = SymmetricSecurityBindingElement.createSecureConversationBindingELement(sm, false)

   2. Create a new custom binding:

      CustomBinding binding1 = new CustomBinding(scsm);

   For more information, see "How to: Define a Windows Communication Foundation Service Contract" at http://msdn.microsoft.com/en-us/library/ms731835.aspx.

2. Create and import a certificate file to the keystore on the web service server.

   Using Microsoft Visual Studio, the command would be similar to the following:

   makecert -r -pe -n "CN=wsmcert3" -sky exchange -ss my C:\wsmcert3.cer

   This command creates and imports a certificate in mmc. If the command does not provide expected results, then try the following sequence of commands. You need to download Windows Developer Kit (WDK) at https://learn.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk.

   makecert -r -pe -n "CN=wsmcert3" -sky exchange -ss my -sv wscert3.pvk C:\wsmcert3.cer
   pvk2pfx.exe -pvk wscert3.pvk -spc wsmcert3.cer -pfx PRF_WSMCert3.pfx -pi password

   Then, in mmc, import PRF_WSMCert3.pfx.

3. Import the certificate created on the web service server to the client server using the keytool command. For example:

   keytool -import -alias wsmcert3 -file C:\wsmcert3.cer -keystore <owsm_client_keystore>

   For more information, see "keytool - Key and Certificate Management Tool" at http://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html.

4. Right-click on the web service Solution project in Solutions Explorer and click Open Folder In Windows Explorer.

5. Navigate to the bin/Debug folder.

6. Double-click the <project>.exe file. This command runs the web service at the URL provided.

You can configure an OWSM 14c client to implement username token with message protection for interoperability with a Microsoft WCF/.NET 4.5 web service.

To configure the OWSM 14c client:

1. Using JDeveloper, create a SOA composite that consumes the .NET web service.

   For more information, see Deploying SOA Composite Applications in Oracle JDeveloper in Developing SOA Applications with Oracle SOA Suite.

2. In JDeveloper, create a partner link using the WSDL of the .NET service.

3. Attach the following policy to the web service client: oracle/wss11_username_token_with_message_protection_client_policy.

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

4. Provide configurations for the csf-key and keystore.recipient.alias.

   You can specify this information when attaching the policy, by overriding the policy configuration. For more information.

   Ensure that you configure the keystore.recipient.alias as the alias of the certificate imported in step 1 (wsmcert3). For example:

   <wsp:PolicyReference 
         URI="oracle/wss11_username_token_with_message_protection_client_policy"
         orawsp:category="security" 
         orawsp:status="enabled"/>
      <property 
         name="csf-key" 
         type="xs:string" 
         many="false">
         basic.credentials
      </property>
      <property 
         name="keystore.recipient.alias" 
         type="xs:string" 
         many="false">
         wsmcert3
      </property>

   For more information, see "Overriding Policy Configuration Properties" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

You can configure an OWSM 14c web service to implement username token over SSL for interoperability with a Microsoft WCF/.NET 4.5 client.

To configure the OWSM 14c web service:

1. Configure the server for SSL.

   For more information, see "Configuring Transport-Level Security (SSL)" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

2. Create an OWSM web service.

3. Select the policy to use based on whether or not you want to enable secure conversation:

   If you do not want to enable secure conversation, attach any of the following policies:

   oracle/wss_username_token_over_ssl_service_policy

   oracle/wss_saml_or_username_token_over_ssl_service_policy

   oracle/wss11_saml_or_username_token_with_message_protection_service_policy

   Note:

   In the case of secure conversation not enabled, you will have to set the establishSecurityContext property to false for the client, as described in "Configuring Microsoft WCF/.NET 4.5 Client (Username Token with Message Protection)".

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager and "Predefined Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

4. Specify that addressing is to be used, as follows:

   For an Oracle Infrastructure web service:

   Attach the following policy:

   oracle/wssaddr_policy

   For a Java EE web service:

   Only a subset of OWSM security policies are supported for Java EE web services and clients, so you cannot attach oracle/wssaddr_policy to a Java EE web service. Rather you must add addressing information using the @Addressing annotation in the source code for the service, as shown in the following example:

   package oracle.wsm.qa.wls.service.soap12;
   import javax.jws.WebMethod;
   import javax.jws.WebParam;
   import javax.jws.WebService;
   import javax.xml.ws.BindingType;
   import javax.xml.ws.soap.Addressing;
   import javax.xml.ws.soap.SOAPBinding;
   import weblogic.wsee.jws.jaxws.owsm.SecurityPolicy;
   @WebService
   @BindingType(SOAPBinding.SOAP12HTTP_BINDING)
   @Addressing(enabled=true)
   public class wss_username_token_over_ssl {
     public wss_username_token_over_ssl() {
       super();
     }
     @WebMethod
     public String sayHello(@WebParam(name = "arg0") String name){
       return "hello "+ name;
     }
   }

   For more information, see the following:

   • "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager

   • "Which OWSM Policies Are Supported for Java EE Web Services and Clients?" in Securing Web Services and Managing Policies with Oracle Web Services Manager

   • "Attaching Policies to Java EE Web Services and Clients at Design TIme" in Securing Web Services and Managing Policies with Oracle Web Services Manager

You can configure a Microsoft WCF/.NET 4.5 client to implement username token over SSL for interoperability with an OWSM 14c web service.

To configure the Microsoft WCF/.NET 4.5 client:

1. Generate a .NET client using the WSDL of the web service.

   For more information, see "How to: Create a Windows Communication Foundation Client" at http://msdn.microsoft.com/en-us/library/ms733133(v=vs.110).aspx.

2. The establishSecurityContext property in the app.config file must be set according to whether you are enabling secure conversation.

   By default, establishSecurityContext is set to true, enabling secure conversation. If you are not enabling secure conversation, set establishSecurityContext to false.

   For example, see the following sample (lines in bold italic):

   <configuration>
     <system.serviceModel>
       <bindings> 
         <ws2007HttpBinding> 
           <binding name="wss_username_over_ssl_client"> 
             <security mode="TransportWithMessageCredential"> 
               <transport clientCredentialType="None" /> 
               <message clientCredentialType="UserName" 
                   negotiateServiceCredential="false" 
                   establishSecurityContext="true" />
                   <!-- extablishSecurityContext is true by default and therefore does not 
                   have to be specified to enable secure conversation.
                   Set establishSecurityContext to false if secure conversation is not enabled -->
             </security> 
           </binding> 
         </ws2007HttpBinding> 
       </bindings> 
       <client> 
         <endpoint address="https://10.244.167.70:7004/OWSMTestApp-Project1-context-root/wss_username_token_over_sslPort" 
             binding="ws2007HttpBinding" 
             bindingConfiguration="wss_username_over_ssl_client" 
             contract="ServiceReference1.wss_username_token_over_ssl" 
             name="wss_username_token_over_sslPort" /> 
       </client>
     </system.serviceModel>
   </configuration>

3. Compile the project.

4. Open a command prompt and navigate to the project's Debug folder.

5. Type <client_project_name>.exe and press Enter.

You can configure a Microsoft WCF/.NET 4.5 web service to implement username token over SSL for interoperability with an OWSM 14c client.

To configure the Microsoft WCF/.NET 4.5 web service:

1. Configure the server for SSL.

   For more information, see "Configuring Transport-Level Security (SSL)" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

2. Create a .NET web service.

   1. Create a custom binding for the web service using the SecurityBindingElement, as shown in the following .NET web service example. This example shows a web service without secure conversation enabled.

      static void Main(string[] args)
      {
          // Step 1 of the address configuration procedure: Create a URI to serve as the 
          // base address.        
          // Step 2 of the hosting procedure: Create ServiceHost
          string uri = "http://host:port/TEST/NetService";
          Uri baseAddress = new Uri(uri);
       
          ServiceHost selfHost = new ServiceHost(typeof(CalculatorService), baseAddress);
       
          try
          {
              SecurityBindingElement sm =
                  SecurityBindingElement.CreateUserNameOverTransportBindingElement();
              sm.DefaultAlgorithmSuite = System.ServiceModel.Security.SecurityAlgorithmSuite.Basic128;
              sm.SetKeyDerivation(false);
              sm.SecurityHeaderLayout = SecurityHeaderLayout.Lax;
              sm.IncludeTimestamp = true;
              sm.KeyEntropyMode = SecurityKeyEntropyMode.CombinedEntropy;
              sm.MessageSecurityVersion = 
              MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005
              WSSecurityPolicy11BasicSecurityProfile10;
              sm.LocalClientSettings.CacheCookies = true;
              sm.LocalClientSettings.DetectReplays = true;
              sm.LocalClientSettings.ReplayCacheSize = 900000;
              sm.LocalClientSettings.MaxClockSkew = new TimeSpan(00, 05, 00);
              sm.LocalClientSettings.MaxCookieCachingTime = TimeSpan.MaxValue;
              sm.LocalClientSettings.ReplayWindow = new TimeSpan(00, 05, 00); ;
              sm.LocalClientSettings.SessionKeyRenewalInterval = new TimeSpan(10, 00, 00);
              sm.LocalClientSettings.SessionKeyRolloverInterval = new TimeSpan(00, 05, 00); ;
              sm.LocalClientSettings.ReconnectTransportOnFailure = true;
              sm.LocalClientSettings.TimestampValidityDuration = new TimeSpan(00, 05, 00); ;
              sm.LocalClientSettings.CookieRenewalThresholdPercentage = 60;
              sm.LocalServiceSettings.DetectReplays = false;
              sm.LocalServiceSettings.IssuedCookieLifetime = new TimeSpan(10, 00, 00);
              sm.LocalServiceSettings.MaxStatefulNegotiations = 128;
              sm.LocalServiceSettings.ReplayCacheSize = 900000;
              sm.LocalServiceSettings.MaxClockSkew = new TimeSpan(00, 05, 00);
              sm.LocalServiceSettings.NegotiationTimeout = new TimeSpan(00, 01, 00);
              sm.LocalServiceSettings.ReplayWindow = new TimeSpan(00, 05, 00);
              sm.LocalServiceSettings.InactivityTimeout = new TimeSpan(00, 02, 00);
              sm.LocalServiceSettings.SessionKeyRenewalInterval = new TimeSpan(15, 00, 00);
              sm.LocalServiceSettings.SessionKeyRolloverInterval = new TimeSpan(00, 05, 00);
              sm.LocalServiceSettings.ReconnectTransportOnFailure = true;
              sm.LocalServiceSettings.MaxPendingSessions = 128;
              sm.LocalServiceSettings.MaxCachedCookies = 1000;
              sm.LocalServiceSettings.TimestampValidityDuration = new TimeSpan(15, 00, 00);
              HttpTransportBindingElement hb = new HttpTransportBindingElement();
              hb.ManualAddressing = false;
              hb.MaxBufferPoolSize = 524288;
              hb.MaxReceivedMessageSize = 65536;
              hb.AllowCookies = false;
              hb.AuthenticationScheme = System.Net.AuthenticationSchemes.Anonymous;
              hb.KeepAliveEnabled = true;
              hb.MaxBufferSize = 65536;
              hb.ProxyAuthenticationScheme = System.Net.AuthenticationSchemes.Anonymous;
              hb.Realm = "";
              hb.TransferMode = System.ServiceModel.TransferMode.Buffered;
              hb.UnsafeConnectionNtlmAuthentication = false;
              hb.UseDefaultWebProxy = true;
              TextMessageEncodingBindingElement tb1 = new TextMessageEncodingBindingElement();
              tb1.MaxReadPoolSize = 64;
              tb1.MaxWritePoolSize = 16;
              tb1.MessageVersion = System.ServiceModel.Channels.MessageVersion.Soap12;
              tb1.WriteEncoding = System.Text.Encoding.UTF8;
              CustomBinding binding1 = new CustomBinding(sm);
              binding1.Elements.Add(tb1);
              binding1.Elements.Add(hb);
              ServiceEndpoint ep = selfHost.AddServiceEndpoint(typeof(ICalculator), binding1,
                "CalculatorService");
       
              EndpointAddress myEndpointAdd = new EndpointAddress(                    
              new Uri(uri),
              EndpointIdentity.CreateDnsIdentity("WSMCert3"));
              ep.Address = myEndpointAdd;
       
              // Step 4 of the hosting procedure: Enable metadata exchange.
              ServiceMetadataBehavior smb = new ServiceMetadataBehavior();
              smb.HttpGetEnabled = true;
              selfHost.Description.Behaviors.Add(smb);
              selfHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.CurrentUser, 
                 StoreName.My,
              X509FindType.FindBySubjectName, "WSMCert3");
              selfHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode =
                  X509CertificateValidationMode.PeerOrChainTrust;
              selfHost.Credentials.UserNameAuthentication.UserNamePasswordValidationMode =
                  UserNamePasswordValidationMode.Custom;
              CustomUserNameValidator cu = new CustomUserNameValidator();
              selfHost.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = cu;
              using (ServiceHost host = new ServiceHost(typeof(CalculatorService)))
              {
                  System.ServiceModel.Description.ServiceDescription svcDesc = selfHost.Description;
                  ServiceDebugBehavior svcDebug = svcDesc.Behaviors.Find<ServiceDebugBehavior>();
                  svcDebug.IncludeExceptionDetailInFaults = true;
              }
       
              // Step 5 of the hosting procedure: Start (and then stop) the service.
              selfHost.Open();
              Console.WriteLine("The Calculator service is ready.");
              Console.WriteLine("Press <ENTER> to terminate service.");
              Console.WriteLine();
              Console.ReadLine();
              selfHost.Close();
          }
          catch (CommunicationException ce)
          {
               Console.WriteLine("An exception occurred: {0}", ce.Message);
               selfHost.Abort();
           }
      }
      

   To enable secure conversation, make the following adjustments to the code in the example:

   1. Create another SecurityBindingElement element based on the one created (sm), for example:

      SecurityBindingElement scsm = SecurityBindingElement.createSecureConversationBindingElement(sm)

   2. Create the custom binding with scsm:

      CustomBinding binding1 = new CustomBinding(scsm);

   For more information, see "How to: Define a Windows Communication Foundation Service Contract" at http://msdn.microsoft.com/en-us/library/ms731835.aspx.

You can configure an OWSM 14c client to implement username token over SSL for interoperability with a Microsoft WCF/.NET 4.5 web service.

To configure an OWSM 14c client:

1. Generate an OWSM client using the WSDL of the web service.

   For more information, see Developer's Guide for SOA Suite.

2. Attach the following policy to the client:

   oracle/wss_username_token_over_ssl_client_policy

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

You can configure an OWSM 14c web service to implement mutual authentication with message protection for interoperability with a Microsoft WCF/.NET 4.5 client.

To configure the OWSM 14c web service:

1. Create a SOAP 1.2 compliant SOA composite and deploy it.

2. Using Fusion Middleware Control, attach the following policy to the web service:

   oracle/wss11_x509_token_with_message_protection_service_policy

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

3. Export wss11_x509_token_with_message_protection_service_policy_net. Change encrypted="true" to "false", and import it back.

   <orasp:x509-token 
      orasp:enc-key-ref-mech="thumbprint" 
      orasp:is-encrypted="false" 
      orasp:is-signed="false" 
      orasp:sign-key-ref-mech="direct"/>

   For more information, see the following links:

   • "Exporting Web Service Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

   • "Importing Web Service Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

4. Attach the policy to the web service.

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

5. Attach the following policy:

   oracle/wsaddr_policy

You can configure a Microsoft WCF/.NET 4.5 client to implement mutual authentication with message protection for interoperability with an OWSM 14c web service.

To configure the Microsoft WCF/.NET 4.5 client:

1. Use the Microsoft SvcUtil utility to create a client proxy (see "Client Program") and configuration file from the deployed web service.

   See the following Client Program sample:

    namespace IO_NET10_client
   {
       class Program
       {
           static void Main(string[] args)
           {
              
               BPELProcess1Client client = new BPELProcess1Client();
            
               client.ClientCredentials.ClientCertificate.SetCertificate(
                       StoreLocation.CurrentUser,
                       StoreName.My,
                       X509FindType.FindBySubjectName, "WSMCert3");
                        
                client.ClientCredentials.ServiceCertificate.SetDefaultCertificate(
                          StoreLocation.CurrentUser,
                          StoreName.My,
                       X509FindType.FindBySubjectName, "Alice");
    
               process proc = new process();
               proc.input = "Test wss11_x509_token_with_message_protection_policy - ";
               Console.WriteLine(proc.input);
               processResponse response = client.process(proc);
              
               Console.WriteLine(response.result.ToString());
               Console.WriteLine("Press <ENTER> to terminate Client.");
               Console.ReadLine();
             }
       }
   }

   For more information, see http://msdn.microsoft.com/en-us/library/aa347733%28v=vs.110%29.aspx.

2. Create a app.config configuration file, as shown in the following sample.

   <?xml version="1.0" encoding="utf-8"?>
   <configuration>
     <system.serviceModel>
       <behaviors>
         <endpointBehaviors>
           <behavior name="secureBehaviour">
             <clientCredentials>
               <serviceCertificate>
                 <defaultCertificate findValue="<certificate_cn>"
                                     storeLocation="CurrentUser"
                                     storeName="My"
                                     x509FindType="FindBySubjectName"/>
               </serviceCertificate>
             </clientCredentials>
           </behavior>
         </endpointBehaviors>
       </behaviors>
         <bindings> 
           <ws2007HttpBinding> 
             <binding name="wss_username_over_ssl_client"> 
               <security mode="TransportWithMessageCredential"> 
               <transport clientCredentialType="None" /> 
               <message clientCredentialType="UserName" 
                   negotiateServiceCredential="false" 
                   establishSecurityContext="false" /> 
               </security> 
             </binding> 
           </ws2007HttpBinding> 
        </bindings> 
           <client>
             <endpoint address="http://<server>:<port>//MyWebService1SoapHttpPort"
                   binding="ws2007HttpBinding"
                   contract="MyWebService1" 
                   name="MyWebService1SoapHttpPort"
                   behaviorConfiguration="secureBehaviour" >
               <identity>
                 <dns value="<certificate_cn>"/>
               </identity>
             </endpoint>
           </client>
       </system.serviceModel>
   </configuration>
   

3. Compile the project.

4. Open a command prompt and navigate to the project's Debug folder.

5. Enter <client_project_name>.exe and press Enter.

You can configure an OWSM 14c web service to implement Kerberos with message protection for interoperability with a Microsoft WCF/.NET 4.5 client.

To configure an OWSM 14c web service:

1. Create and deploy a web service application.

   For more information, see "Deploying Web Service Applications" in Administering Web Services.

2. Clone the following policy: oracle/wss11_kerberos_token_with_message_protection_service_policy.

   For more information, see "Cloning a Web Service Policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

3. Edit the policy settings to set Algorithm Suite to Basic128Rsa15.

4. Attach the policy to the web service.

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

You can configure a Microsoft WCF/.NET 4.5 client to implement Kerberos with message protection for interoperability with an OWSM 14c web service.

To configure the Microsoft WCF/.NET 4.5 client:

1. Create a user in AD to represent the host where the web service is hosted. By default the user account is created with RC4-HMAC encryption. For example, foobar with user name is HTTP/foobar.

2. Use the following ktpass command to create a keytab file on the Windows AD machine where the KDC is running:

   ktpass -princ HTTP/foobar@MYCOMPANY.LOCAL -pass Oracle123 -mapuser foobar -out foobar.keytab -ptype KRB5_NT_PRINCIPAL -kvno 4

   where HTTP/foobar is the SPN, mapped to a user "foobar". Do not set "/desonly or cyrpto as "des-cbc-crc". MYCOMPANY.LOCAL is the default Realm for the KDC and is available in the krb5.ini file. The pass password must match the password created during the user creation.

   Use FTP binary mode to move the generated keytab file to the machine where the SOA Composite web service is hosted.

3. setSpn -L foobar

   setSpn -A HTTP/foobar@MYCOMPANY.LOCAL foobar

   Only one SPN must be mapped to the user. If there are multiple SPNs mapped to the user, remove them using the command setSpn -D <spname> <username>.

   Use the following setSpn command to map the service principal to the user:

   setSpn -A HTTP/foobar@MYCOMPANY.LOCAL foobar

   setSpn -L foobar

   Only one SPN must be mapped to the user. If there are multiple SPNs mapped to the user, remove them using the command setSpn -D <spname> <username>.

4. Use the Microsoft SvcUtil utility to create a client proxy and configuration file from the deployed web service.

   Add the files generatedProxy.cs and app.config by right clicking the application (in the Windows Explorer) and selecting Add Existing Item.

   In the endpoint element of the app.config, add an "identity" element with service principal name as "HTTP/foobar@MYCOMPANY.LOCAL" (the same value used for creating keytab).

   <client>
           <endpoint address="http://host:port/HelloServicePort"
               binding="customBinding" bindingConfiguration="NewHelloSoap12HttpPortBinding"
               contract="NewHello" name="HelloServicePort">
           <identity>
             <servicePrincipalName value ="HTTP/foobar@MYCOMPANY.LOCAL"/>
           </identity>
           </endpoint>
          
         </client>

   See the following Custom Binding sample:

   <customBinding>
     <binding name="NewHelloSoap12HttpPortBinding">
         <!--Added by User: Begin-->
         <security defaultAlgorithmSuite="Basic128"
           authenticationMode="Kerberos"
           requireDerivedKeys="false" securityHeaderLayout="Lax"
           includeTimestamp="true"
           keyEntropyMode="CombinedEntropy"
           messageProtectionOrder="SignBeforeEncrypt"
           messageSecurityVersion="WSSecurity11WSTrustFebruary2005
           WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurity
             Profile10" 
           requireSignatureConfirmation="true">
         <localClientSettings cacheCookies="true" detectReplays="true"
             replayCacheSize="900000" maxClockSkew="00:05:00"
             maxCookieCachingTime="Infinite"
             replayWindow="00:05:00"
             sessionKeyRenewalInterval="10:00:00"
             sessionKeyRolloverInterval="00:05:00"
             reconnectTransportOnFailure="true"
             timestampValidityDuration="00:05:00"
             cookieRenewalThresholdPercentage="60" />
                   <localServiceSettings detectReplays="true"
             issuedCookieLifetime="10:00:00"
             maxStatefulNegotiations="128" replayCacheSize="900000"
             maxClockSkew="00:05:00"
             negotiationTimeout="00:01:00" replayWindow="00:05:00"
             inactivityTimeout="00:02:00"
             sessionKeyRenewalInterval="15:00:00"
             sessionKeyRolloverInterval="00:05:00"
             reconnectTransportOnFailure="true"
             maxPendingSessions="128"
             maxCachedCookies="1000"
             timestampValidityDuration="00:05:00" />
                     <secureConversationBootstrap />
                   </security>
                 <!--Added by User: End-->
                   <textMessageEncoding maxReadPoolSize="64"
                      maxWritePoolSize="16"
                      messageVersion="Soap12" writeEncoding="utf-8">
                   <readerQuotas maxDepth="32" maxStringContentLength="8192"
                      maxArrayLength="16384"
                      maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                   </textMessageEncoding>
                 <!--Added by User: Begin-->
                 <httpTransport manualAddressing="false"
                      maxBufferPoolSize="524288"
                      maxReceivedMessageSize="65536" allowCookies="false"
                      authenticationScheme="Anonymous"
                      bypassProxyOnLocal="false"
                      hostNameComparisonMode="StrongWildcard"
                      keepAliveEnabled="true" maxBufferSize="65536"
                      proxyAuthenticationScheme="Anonymous"
                      realm="" transferMode="Buffered"
                      unsafeConnectionNtlmAuthentication="false"
                      useDefaultWebProxy="true" />
                   <!--Added by User: End-->
              </binding>
   </customBinding>
   

   For more information, see http://msdn.microsoft.com/en-us/library/aa347733%28v=vs.110%29.aspx.

5. Run the client program.

You can configure an OWSM 14c web service to implement Kerberos with message protection using derived keys for interoperability with a Microsoft WCF/.NET 4.5 client.

To configure an OWSM 14c web service:

1. Create and deploy a web service application.

   For more information, see "Deploying Web Service Applications" in Administering Web Services.

2. Clone the following policy: wss11_kerberos_token_with_message_protection_basic128_service_policy.

   For more information, see "Cloning a Web Service Policy" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

3. Edit the policy settings to enable the Derived Keys option.

4. Attach the policy to the web service.

   For more information, see "Attaching Policies" in Securing Web Services and Managing Policies with Oracle Web Services Manager.

You can configure a Microsoft WCF/.NET 4.5 client to implement Kerberos with message protection using derived keys for interoperability with an OWSM 14c web service.

To configure the Microsoft WCF/.NET 4.5 client:

1. Create a user in AD to represent the host where the web service is hosted. By default the user account is created with RC4-HMAC encryption. For example, foobar with user name as "HTTP/foobar".

2. Use the following ktpass command to create a keytab file on the Windows AD machine where the KDC is running:

   ktpass -princ HTTP/foobar@MYCOMPANY.LOCAL -pass Oracle123 -mapuser foobar -out foobar.keytab -ptype KRB5_NT_PRINCIPAL -kvno 4

   where HTTP/foobar is the SPN, mapped to a user "foobar". Do not set "/desonly or cyrpto as "des-cbc-crc". MYCOMPANY.LOCAL is the default Realm for the KDC and is available in the krb5.ini file. The pass password must match the password created during the user creation.

   Use FTP binary mode to move the generated keytab file to the machine where the SOA Composite web service is hosted.

3. Use the following setSpn command to map the service principal to the user:

   setSpn -A HTTP/foobar@MYCOMPANY.LOCAL foobar

   setSpn -L foobar

   Only one SPN must be mapped to the user. If there are multiple SPNs mapped to the user, remove them using the command setSpn -D <spname> <username>.

4. Use the Microsoft SvcUtil utility to create a client proxy and configuration file from the deployed web service.

   Add the files generatedProxy.cs and app.config by right clicking the application (in the Windows Explorer) and selecting Add Existing Item.

   In the endpoint element of the app.config, add an "identity" element with service principal name as "HTTP/foobar@MYCOMPANY.LOCAL" (the same value used for creating keytab).

   <client>
           <endpoint address="http://host:port/HelloServicePort"
               binding="customBinding" bindingConfiguration="NewHelloSoap12HttpPortBinding"
               contract="NewHello" name="HelloServicePort">
           <identity>
             <servicePrincipalName value ="HTTP/foobar@MYCOMPANY.LOCAL"/>
           </identity>
           </endpoint>
         </client>

   See the following Custom Binding sample:

   <customBinding>
     <binding name="NewHelloSoap12HttpPortBinding">
       <!--Added by User: Begin-->
       <security defaultAlgorithmSuite="Basic128"
         authenticationMode="Kerberos"
         requireDerivedKeys="true" securityHeaderLayout="Lax"
         includeTimestamp="true"
         keyEntropyMode="CombinedEntropy"
         messageProtectionOrder="SignBeforeEncrypt"
         messageSecurityVersion="WSSecurity11WSTrustFebruary2005
         WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurity
         Profile10" 
         requireSignatureConfirmation="true">
       <localClientSettings cacheCookies="true" detectReplays="true"
           replayCacheSize="900000" maxClockSkew="00:05:00"
           maxCookieCachingTime="Infinite"
           replayWindow="00:05:00"
           sessionKeyRenewalInterval="10:00:00"
           sessionKeyRolloverInterval="00:05:00"
           reconnectTransportOnFailure="true"
           timestampValidityDuration="00:05:00"
           cookieRenewalThresholdPercentage="60" />
         <localServiceSettings detectReplays="true"
           issuedCookieLifetime="10:00:00"
           maxStatefulNegotiations="128" replayCacheSize="900000"
           maxClockSkew="00:05:00"
           negotiationTimeout="00:01:00" replayWindow="00:05:00"
           inactivityTimeout="00:02:00"
           sessionKeyRenewalInterval="15:00:00"
           sessionKeyRolloverInterval="00:05:00"
           reconnectTransportOnFailure="true"
           maxPendingSessions="128"
           maxCachedCookies="1000"
           timestampValidityDuration="00:05:00" />
         <secureConversationBootstrap />
       </security>
     <!--Added by User: End-->
         <textMessageEncoding maxReadPoolSize="64"
           maxWritePoolSize="16"
           messageVersion="Soap12" writeEncoding="utf-8">
             <readerQuotas maxDepth="32" maxStringContentLength="8192"
               maxArrayLength="16384"
               maxBytesPerRead="4096" maxNameTableCharCount="16384" />
         </textMessageEncoding>
             <!--Added by User: Begin-->
         <httpTransport manualAddressing="false"
           maxBufferPoolSize="524288"
           maxReceivedMessageSize="65536" allowCookies="false"
           authenticationScheme="Anonymous"
           bypassProxyOnLocal="false"
           hostNameComparisonMode="StrongWildcard"
           keepAliveEnabled="true" maxBufferSize="65536"
           proxyAuthenticationScheme="Anonymous"
           realm="" transferMode="Buffered"
           unsafeConnectionNtlmAuthentication="false"
           useDefaultWebProxy="true" />
         <!--Added by User: End-->
     </binding>
   </customBinding>
   

5. Run the client program.