MessageSecurityOverHttp.NegotiateServiceCredential Property

Gets or sets a value that indicates whether the service credential is provisioned at the client out of band or is obtained from the service through a process of negotiation.

Namespace: System.ServiceModel
Assembly: System.ServiceModel (in system.servicemodel.dll)

public bool NegotiateServiceCredential { get; set; }
/** @property */
public boolean get_NegotiateServiceCredential ()

/** @property */
public void set_NegotiateServiceCredential (boolean value)

public function get NegotiateServiceCredential () : boolean

public function set NegotiateServiceCredential (value : boolean)

Not applicable.

Property Value

true if service credential is obtained through a process of negotiation; otherwise, false. The default is true.

Setting this property to true, requires WS-Trust and WS-SecureConversation to be supported by the client and the service. Setting this property to false does not require WS-Trust or WS-SecureConversation to be supported.

For Anonymous, Username or Certificate client credential types, setting this property to false implies that the service certificate must be available at the client out of band and that the client must specify the service's certificate to use.

In the case of Windows credentials setting this property to false causes a KerberosToken-based authentication. This requires that the client and service be part of a Kerberos domain. This mode is interoperable with SOAP stacks that implement the Kerberos token profile from OASIS. Setting this property to true causes a SOAP negotiation that tunnels SPNego exchange over SOAP messages. This mode is not interoperable.

This property indicates whether the service credential is negotiated automatically between the client and the service. If this property is true, then such negotiation occurs. If this property is false, then the service credentials must be specified at the client before communication with the service can occur.

If this property is set to false, and the binding is configured to use Windows as a client credential type, the service account must be associated with a Service Principal Name (SPN). To do this, run the service under the NETWORK SERVICE account, or LOCAL SYSTEM account. Alternatively, use the SetSpn.exe tool to create an SPN for the service account. In either case, the client must use the correct SPN in the <servicePrincipalName> element, or by using the EndpointAddress constructor. For more information, see Specifying the Identity.

The following code shows how to access and set this property.

WSHttpBinding binding = new WSHttpBinding();
binding.Security.Mode = SecurityMode.Message;
binding.Security.Message.ClientCredentialType =
binding.Security.Message.NegotiateServiceCredential = false;

CalculatorClient CalculatorClient = new CalculatorClient("myBinding");
    SetDefaultCertificate("Al", StoreLocation.CurrentUser, StoreName.My);

Windows 98, Windows Server 2000 SP4, Windows CE, Windows Millennium Edition, Windows Mobile for Pocket PC, Windows Mobile for Smartphone, Windows Server 2003, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP SP2, Windows XP Starter Edition

The Microsoft .NET Framework 3.0 is supported on Windows Vista, Microsoft Windows XP SP2, and Windows Server 2003 SP1.

.NET Framework

Supported in: 3.0