Export (0) Print
Expand All

How to: Disable Secure Sessions on a WSFederationHttpBinding

Some services may require federated credentials but not support secure sessions. In that case, you must disable the secure session feature. Unlike the WsHttpBinding, the WSFederationHttpBinding class does not provide a way to disable secure sessions when communicating with a service. Instead, you must create a custom binding that replaces the secure session settings with a bootstrap.

This topic demonstrates how to modify the binding elements contained within a WSFederationHttpBinding to create a custom binding. The result is identical to the WSFederationHttpBinding except that it does not use secure sessions.

To create a custom federated binding without secure session

  1. Create an instance of the WSFederationHttpBinding class either imperatively in code or by loading one from the configuration file.

  2. Clone the WSFederationHttpBinding into a CustomBinding.

  3. Find the SecurityBindingElement in the CustomBinding.

  4. Find the SecureConversationSecurityTokenParameters in the SecurityBindingElement.

  5. Replace the original SecurityBindingElement with the bootstrap security binding element from the SecureConversationSecurityTokenParameters.

Example

This following example creates a custom federated binding without secure session.

using System;
using System.Collections.Generic;
using System.ServiceModel;
using System.ServiceModel.Channels;
using System.ServiceModel.Security.Tokens;
using System.Security.Permissions;
[assembly: SecurityPermission(
   SecurityAction.RequestMinimum, Execution = true)]
namespace Samples
{
    
    public sealed class CustomBindingCreator
    {
        // This method creates a CustomBinding based on a WSFederationHttpBinding which does not use secure conversation.
        public static CustomBinding CreateFederationBindingWithoutSecureSession(WSFederationHttpBinding inputBinding)
        {
            // This CustomBinding starts out identical to the specified WSFederationHttpBinding.
            CustomBinding outputBinding = new CustomBinding(inputBinding.CreateBindingElements());
            // Find the SecurityBindingElement for message security.
            SecurityBindingElement security = outputBinding.Elements.Find<SecurityBindingElement>();
            // If the security mode is message, then the secure session settings are the protection token parameters.
            SecureConversationSecurityTokenParameters secureConversation;
            if (WSFederationHttpSecurityMode.Message == inputBinding.Security.Mode)
            {
                SymmetricSecurityBindingElement symmetricSecurity = security as SymmetricSecurityBindingElement;
                secureConversation = symmetricSecurity.ProtectionTokenParameters as SecureConversationSecurityTokenParameters;
            }
            // If the security mode is message, then the secure session settings are the endorsing token parameters.
            else if (WSFederationHttpSecurityMode.TransportWithMessageCredential == inputBinding.Security.Mode)
            {
                TransportSecurityBindingElement transportSecurity = security as TransportSecurityBindingElement;
                secureConversation = transportSecurity.EndpointSupportingTokenParameters.Endorsing[0] as SecureConversationSecurityTokenParameters;
            }
            else
            {
                throw new NotSupportedException(String.Format("Unhandled security mode {0}.", inputBinding.Security.Mode));
            }
            // Replace the secure session SecurityBindingElement with the bootstrap SecurityBindingElement.
            int securityIndex = outputBinding.Elements.IndexOf(security);
            outputBinding.Elements[securityIndex] = secureConversation.BootstrapSecurityBindingElement;
            // Return modified binding.
            return outputBinding;
        }
        // It is a good practice to create a private constructor for a class that only 
        // defines static methods.
        private CustomBindingCreator() { }
        static void Main() 
        { 
            // Code not shown.
        }

    }

Compiling the Code

  • To compile the code example, create a project that references the System.ServiceModel.dll assembly.

See Also


© 2007 Microsoft Corporation. All rights reserved.
Last Published: 2010-03-21

Community Additions

ADD
Show:
© 2014 Microsoft