title: How to create a specific SOAP header for a third-party web service
body: <p>I am trying to connect to a third party web service. I have tried to do it in multiple ways, but I have been unable. They use java for service and for the client, and they have sent me what should be the correct header:</p>
  
  <pre><code>&lt;soapenv:Header&gt;
  &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
      &lt;ds:Signature Id="SIG-DF651A72BB4BD472F5149301750204095" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                  &lt;ec:InclusiveNamespaces PrefixList="doc soapenv web" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
              &lt;/ds:CanonicalizationMethod&gt;
              &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
              &lt;ds:Reference URI="#id-DF651A72BB4BD472F5149301750203994"&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                          &lt;ec:InclusiveNamespaces PrefixList="doc web" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                      &lt;/ds:Transform&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                  &lt;ds:DigestValue&gt;iITj5pTonO3g052LVSnea1yZd0Q=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;DhsMfNnidlHk7QIRAWBrr44T6nMLLG00AN/1jnZSlV7pbrMZ3V/MrvW1S5hzQYGQXRH1U1bqzCw8wF2nGtizDtagWGR9UfBoq+wvFBktQy6f7B91DbN++q03a28i2iiSxiEOVWaCvZzCmwOOLdOIIvaD8c8YsJAIgzB+wGg1s6d14+0rk4zAEQrtu7hWvOtU3s6aKIMrX9JiP+1qVInI4RPWynZ9pIbB87vaZSMHsqkjexxKMBB7v5sZugDjl2gPsJeE4dbtC8pXrfZ4QhQ+HSsEYvMJ90J8zyoG2gLuOeCrcQDBe6RrdwpP20r2sTFMKpy2ADZnl1LkwbadvLvnQ==&lt;/ds:SignatureValue&gt;
          &lt;ds:KeyInfo Id="KI-DF651A72BB4BD472F5149301750203992"&gt;
              &lt;wsse:SecurityTokenReference wsu:Id="STR-DF651A72BB4BD472F5149301750203993"&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509IssuerSerial&gt;
                          &lt;ds:X509IssuerName&gt;OU=yyy,O=xxx,C=ES&lt;/ds:X509IssuerName&gt;
                          &lt;ds:X509SerialNumber&gt;a very long integer here&lt;/ds:X509SerialNumber&gt;
                      &lt;/ds:X509IssuerSerial&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/wsse:SecurityTokenReference&gt;
          &lt;/ds:KeyInfo&gt;
      &lt;/ds:Signature&gt;
  &lt;/wsse:Security&gt;
  &lt;/soapenv:Header&gt;
  </code></pre>
  
  <p>I tried different bindings, like this one:</p>
  
  <pre><code>        &lt;basicHttpBinding&gt;
              &lt;binding name="GInsideCertificateWSSoapBinding"  &gt;
                &lt;security mode="TransportWithMessageCredential"    &gt;
                  &lt;message clientCredentialType="Certificate"  /&gt;
                &lt;/security&gt;
              &lt;/binding&gt;
           &lt;/basicHttpBinding&gt;
  </code></pre>
  
  <p>And this one:</p>
  
  <pre><code>      &lt;customBinding&gt;
          &lt;binding name="CustomSoapBinding"&gt;
            &lt;security includeTimestamp="true"
                      authenticationMode="CertificateOverTransport"
                      defaultAlgorithmSuite="Basic256"
                      requireDerivedKeys="false"
                      messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"
                      &gt;
            &lt;/security&gt;
            &lt;textMessageEncoding messageVersion="Soap11"&gt;&lt;/textMessageEncoding&gt;
            &lt;httpsTransport maxReceivedMessageSize="2000000000"/&gt;
          &lt;/binding&gt;
        &lt;/customBinding&gt;
  </code></pre>
  
  <p>I also tried this code:
  <a href="https://msdn.microsoft.com/en-us/library/microsoft.web.services2.security.tokens.binarysecuritytoken.aspx" rel="nofollow noreferrer">https://msdn.microsoft.com/en-us/library/microsoft.web.services2.security.tokens.binarysecuritytoken.aspx</a></p>
  
  <p>But no one generates a header like the one they sent me. What kind of security is implemented? They told me BinarySecurityToken, but I cannot connect to the service anyways.</p>
  
  <p>Any ideas?</p>