Verify SOAP Messages Signed using Username and Password

To validate digital signatures for incoming SOAP Messages created using Username Token, WSE Must be configured.

The following procedure explains how to configure a WSE to validate digital signatures created using Username Token.

1. Start Visual studio 2005

2. File Menu, New then click Project.

3. Select ASP.NET Web Service in  the templates pane.

4. Add a reference to the Microsoft.Web.Services3 assembly.

5. In the Web.config file include the <SoapServerProtocolFactory> element in <webServices> section.

<configuration>
   <system.web>
        <webServices>
            <soapServerProtocolFactory 

type="Microsoft.Web.Services3.WseProtocolFactory,

 Microsoft.Web.Services3,

 Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
        </webServices>
    </system.web>
   </system.web>
</configuration>

  Write the following code to validate the SOAP Message

protected override string AuthenticateToken(UsernameToken userName)
{
    // Ensure that the SOAP message sender passed a UsernameToken.
    if (userName == null)
        throw new ArgumentNullException();

    // This is a very simple provider.
    // In most production systems the following code 
    // typically consults an external database of (userName,hash)
    // pairs. For this example, it is the UTF-8
    // encoding of the user name.
    byte[] password =
        System.Text.Encoding.UTF8.GetBytes(userName.Username);
    Array.Reverse( password );

    return Convert.ToBase64String( password );
}

public override void  ValidateMessageSecurity(SoapEnvelope envelope, Security security)
{

bool IsSigned = false;
foreach (ISecurityElement element in security.Elements)
{
    if (element is MessageSignature)
    {
        // The given context contains a Signature element.
        MessageSignature sign = element as MessageSignature;

        SignatureOptions expectedOptions = 

             SignatureOptions.IncludeTimestamp |
             SignatureOptions.IncludeSoapBody |
             SignatureOptions.IncludeTo |
             SignatureOptions.IncludeAction |
             SignatureOptions.IncludeMessageId;
        if ((sign.SignatureOptions & expectedOptions)==expectedOptions)
        {
            // The SOAP message is signed.
            if (sign.SigningToken is UsernameToken)
                // The SOAP message is signed 
                // with a UsernameToken.
                IsSigned = true;
        }
    }
}
if (!IsSigned)
    throw new SecurityFault("Message did not meet

 security requirements.");

}