Edit

How to: Set a Max Clock Skew

  • Article

Time-critical functions can be derailed if the clock settings on two computers are different. To mitigate this possibility, you can set the MaxClockSkew property to a TimeSpan. This property is available on two classes:

LocalClientSecuritySettings

LocalServiceSecuritySettings

Important

For a secure conversation, changes to the MaxClockSkew property must be made when the service or client is bootstrapped. To do this, you must set the property on the SecurityBindingElement returned by the SecureConversationSecurityTokenParameters.BootstrapSecurityBindingElement property.

To change the property on one of the system-provided bindings, you must find the security binding element in the collection of bindings and set the MaxClockSkew property to a new value. Two classes derive from the SecurityBindingElement: SymmetricSecurityBindingElement and AsymmetricSecurityBindingElement. When retrieving the security binding from the collection, you must cast to one of these types in order to correctly set the MaxClockSkew property. The following example uses a WSHttpBinding, which uses the SymmetricSecurityBindingElement. For a list that specifies which type of security binding to use in each system-provided binding, see System-Provided Bindings.

To create a custom binding with a new clock skew value in code

Warning

Add references to the following namespaces in your code: System.ServiceModel.Channels, System.ServiceModel.Description, System.Security.Permissions, and System.ServiceModel.Security.Tokens.

  1. Create an instance of a WSHttpBinding class and set its security mode to SecurityMode.Message.

  2. Create a new instance of the BindingElementCollection class by calling the CreateBindingElements method.

  3. Use the Find method of the BindingElementCollection class to find the security binding element.

  4. When using the Find method, cast to the actual type. The example below casts to the SymmetricSecurityBindingElement type.

  5. Set the MaxClockSkew property on the security binding element.

  6. Create a ServiceHost with an appropriate service type and base address.

  7. Use the AddServiceEndpoint method to add an endpoint and include the CustomBinding.

    // This method returns a custom binding created from a WSHttpBinding. Alter the method
// to use the appropriate binding for your service, with the appropriate settings.
public static Binding CreateCustomBinding(TimeSpan clockSkew)
{
    WSHttpBinding standardBinding = new WSHttpBinding(SecurityMode.Message, true);
    CustomBinding myCustomBinding = new CustomBinding(standardBinding);
    SymmetricSecurityBindingElement security =
        myCustomBinding.Elements.Find<SymmetricSecurityBindingElement>();
    security.LocalClientSettings.MaxClockSkew = clockSkew;
    security.LocalServiceSettings.MaxClockSkew = clockSkew;
    // Get the System.ServiceModel.Security.Tokens.SecureConversationSecurityTokenParameters
    SecureConversationSecurityTokenParameters secureTokenParams =
        (SecureConversationSecurityTokenParameters)security.ProtectionTokenParameters;
    // From the collection, get the bootstrap element.
    SecurityBindingElement bootstrap = secureTokenParams.BootstrapSecurityBindingElement;
    // Set the MaxClockSkew on the bootstrap element.
    bootstrap.LocalClientSettings.MaxClockSkew = clockSkew;
    bootstrap.LocalServiceSettings.MaxClockSkew = clockSkew;
    return myCustomBinding;
}

private void Run()
{
    // Create a custom binding using the method defined above. The MaxClockSkew is set to 30 minutes.
    Binding customBinding= CreateCustomBinding(TimeSpan.FromMinutes(30));

    // Create a ServiceHost instance, and add a metadata endpoint.
    // NOTE  When using Visual Studio, you must run as administrator.
    Uri baseUri = new Uri("http://localhost:1008/");
    ServiceHost sh = new ServiceHost(typeof(Calculator), baseUri);

    // Optional. Add a metadata endpoint. The method is defined below.
    AddMetadataEndpoint(ref sh);

    // Add an endpoint using the binding, and open the service.
    sh.AddServiceEndpoint(typeof(ICalculator), customBinding, "myCalculator");

    sh.Open();
    Console.WriteLine("Listening...");
    Console.ReadLine();
}

private void AddMetadataEndpoint(ref ServiceHost sh)
{
    Uri mex = new Uri(@"http://localhost:1001/metadata/");
    ServiceMetadataBehavior sm = new ServiceMetadataBehavior();
    sm.HttpGetEnabled = true;
    sm.HttpGetUrl = mex;
    sh.Description.Behaviors.Add(sm);
}


    ' This method returns a custom binding created from a WSHttpBinding. Alter the method 
' to use the appropriate binding for your service, with the appropriate settings.
Public Shared Function CreateCustomBinding(ByVal clockSkew As TimeSpan) As Binding

    Dim standardBinding As WSHttpBinding = New WSHttpBinding(SecurityMode.Message, True)
    Dim myCustomBinding As CustomBinding = New CustomBinding(standardBinding)
    Dim security As SymmetricSecurityBindingElement = _
        myCustomBinding.Elements.Find(Of SymmetricSecurityBindingElement)()
    security.LocalClientSettings.MaxClockSkew = clockSkew
    security.LocalServiceSettings.MaxClockSkew = clockSkew
    ' Get the System.ServiceModel.Security.Tokens.SecureConversationSecurityTokenParameters 
    Dim secureTokenParams As SecureConversationSecurityTokenParameters = _
         CType(security.ProtectionTokenParameters, SecureConversationSecurityTokenParameters)
    ' From the collection, get the bootstrap element.
    Dim bootstrap As SecurityBindingElement = secureTokenParams.BootstrapSecurityBindingElement
    ' Set the MaxClockSkew on the bootstrap element.
    bootstrap.LocalClientSettings.MaxClockSkew = clockSkew
    bootstrap.LocalServiceSettings.MaxClockSkew = clockSkew
    Return myCustomBinding
End Function

Private Sub Run()

    ' Create a custom binding using the method defined above. The MaxClockSkew is set to 30 minutes. 
    Dim customBinding As Binding = CreateCustomBinding(TimeSpan.FromMinutes(30))

    ' Create a ServiceHost instance, and add a metadata endpoint.
    ' NOTE  When using Visual Studio, you must run as administrator.
    Dim baseUri As New Uri("http://localhost:1008/")
    Dim sh As New ServiceHost(GetType(Calculator), baseUri)

    ' Optional. Add a metadata endpoint. The method is defined below.
    AddMetadataEndpoint(sh)

    ' Add an endpoint using the binding, and open the service.
    sh.AddServiceEndpoint(GetType(ICalculator), customBinding, "myCalculator")

    sh.Open()
    Console.WriteLine("Listening...")
    Console.ReadLine()
End Sub

Private Sub AddMetadataEndpoint(ByRef sh As ServiceHost)

    Dim mex As New Uri("http://localhost:1011/metadata/")
    Dim sm As New ServiceMetadataBehavior()
    sm.HttpGetEnabled = True
    sm.HttpGetUrl = mex
    sh.Description.Behaviors.Add(sm)
End Sub

To set the MaxClockSkew in configuration

  1. Create a <customBinding> in the <bindings> element section.

  2. Create a <binding> element and set the name attribute to an appropriate value. The following example sets it to MaxClockSkewBinding.

  3. Add an encoding element. The example below adds a <textMessageEncoding>.

  4. Add a <security> element and set the authenticationMode attribute to an appropriate setting. The following example set the attribute to Kerberos to specify that the service use Windows authentication.

  5. Add a <localServiceSettings> and set the maxClockSkew attribute to a value in the form of "##:##:##". The following example sets it to 7 minutes. Optionally, add a <localServiceSettings> and set the maxClockSkew attribute to an appropriate setting.

  6. Add a transport element. The following example uses an <httpTransport>.

  7. For a secure conversation, the security settings must occur at the bootstrap in the <secureConversationBootstrap> element.

    <bindings>  
  <customBinding>  
    <binding name="MaxClockSkewBinding">  
        <textMessageEncoding />  
        <security authenticationMode="Kerberos">  
           <localClientSettings maxClockSkew="00:07:00" />  
           <localServiceSettings maxClockSkew="00:07:00" />  
           <secureConversationBootstrap>  
              <localClientSettings maxClockSkew="00:30:00" />  
              <localServiceSettings maxClockSkew="00:30:00" />  
           </secureConversationBootstrap>  
        </security>  
        <httpTransport />  
    </binding>  
  </customBinding>  
</bindings>

See also