MessageSecurityOverHttp.NegotiateServiceCredential Property (System.ServiceModel)

NegotiateServiceCredential Property

Collapse All

Language Filter

This page is specific to

Microsoft Visual Studio 2008/.NET Framework 3.5

Other versions are also available for the following:

.NET Framework Class Library

MessageSecurityOverHttp..::.NegotiateServiceCredential Property

Gets or sets a value that indicates whether the service credential is provisioned at the client out of band or is obtained from the service through a process of negotiation.

Namespace: System.ServiceModel
Assembly: System.ServiceModel (in System.ServiceModel.dll)

Syntax

Visual Basic (Declaration)

Public Property NegotiateServiceCredential As Boolean

Visual Basic (Usage)

Dim instance As MessageSecurityOverHttp
Dim value As Boolean

value = instance.NegotiateServiceCredential

instance.NegotiateServiceCredential = value

public bool NegotiateServiceCredential { get; set; }

Visual C++

public:
property bool NegotiateServiceCredential {
    bool get ();
    void set (bool value);
}

JScript

public function get NegotiateServiceCredential () : boolean
public function set NegotiateServiceCredential (value : boolean)

Property Value

Type: System..::.Boolean
true if service credential is obtained through a process of negotiation; otherwise, false. The default is true.

Remarks

Setting this property to true, requires WS-Trust and WS-SecureConversation to be supported by the client and the service. Setting this property to false does not require WS-Trust or WS-SecureConversation to be supported.

For Anonymous, Username or Certificate client credential types, setting this property to false implies that the service certificate must be available at the client out of band and that the client must specify the service's certificate to use.

In the case of Windows credentials, setting this property to false causes an authentication based on KerberosToken. This requires that the client and service be part of a Kerberos domain. This mode is interoperable with SOAP stacks that implement the Kerberos token profile from OASIS. Setting this property to true causes a SOAP negotiation that tunnels SPNego exchange over SOAP messages. This mode is not interoperable.

This property indicates whether the service credential is negotiated automatically between the client and the service. If this property is true, then such negotiation occurs. If this property is false, then the service credentials must be specified at the client before communication with the service can occur.

If this property is set to false, and the binding is configured to use Windows as a client credential type, the service account must be associated with a Service Principal Name (SPN). To do this, run the service under the NETWORK SERVICE account, or LOCAL SYSTEM account. Alternatively, use the SetSpn.exe tool to create an SPN for the service account. In either case, the client must use the correct SPN in the <servicePrincipalName> element, or by using the EndpointAddress constructor. For more information, see Specifying the Identity.

Examples

The following code shows how to access and set this property.

Visual Basic

Dim binding As New WSHttpBinding()
binding.Security.Mode = SecurityMode.Message
binding.Security.Message.ClientCredentialType = _
MessageCredentialType.UserName
binding.Security.Message.NegotiateServiceCredential = False

Dim CalculatorClient As New CalculatorClient("myBinding")
CalculatorClient.ClientCredentials.ServiceCertificate. _
    SetDefaultCertificate("Al", StoreLocation.CurrentUser, StoreName.My)

WSHttpBinding binding = new WSHttpBinding();
binding.Security.Mode = SecurityMode.Message;
binding.Security.Message.ClientCredentialType =
    MessageCredentialType.UserName;
binding.Security.Message.NegotiateServiceCredential = false;

CalculatorClient CalculatorClient = new CalculatorClient("myBinding");
CalculatorClient.ClientCredentials.ServiceCertificate.
    SetDefaultCertificate("Al", StoreLocation.CurrentUser, StoreName.My);

.NET Framework Security

Full trust for the immediate caller. This member cannot be used by partially trusted code. For more information, see Using Libraries from Partially Trusted Code.

Platforms

Windows 7, Windows Vista, Windows XP SP2, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

Version Information

.NET Framework

Supported in: 3.5, 3.0

Reference

MessageSecurityOverHttp Class

MessageSecurityOverHttp Members

System.ServiceModel Namespace