title: username token in soap ws security http
body: <p>This is the first part soap header I am trying to generate</p>
  
  <pre><code> &lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:mhs="http://org/emedny/mhs/" xmlns:urn="urn:hl7-org:v3"&gt;
  &lt;soapenv:Header&gt;
  &lt;wsse:Security soap:mustUnderstand="1" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
  &lt;wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-e00c8062-83d2-4f04-88fc-996218e7bb3d"&gt;MIICeDCC....(eMedNY signed user MLS cert).......&lt;/wsse:BinarySecurityToken&gt;
  &lt;wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-c0cc2cd4-cb77-4fa5-abfa-bd485afd1685"&gt;MIIDFj.....( eMedNY MLS web-service end-point public cert)........&lt;/wsse:BinarySecurityToken&gt;
  &lt;wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="SecurityToken-970e9a80-00cc-4c86-8ec4-3ba16e029a5b"&gt;
  &lt;wsse:Username&gt;....your_username.....&lt;/wsse:Username&gt;
  &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;.....your_plaintext_password....&lt;/wsse:Password&gt;
  &lt;wsse:Nonce&gt;KNyu6MsXCkTg4DDyvwvEiw==&lt;/wsse:Nonce&gt;
  &lt;wsu:Created&gt;2010-09-15T18:00:30Z&lt;/wsu:Created&gt;
  &lt;/wsse:UsernameToken&gt;
  &lt;xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;
  &lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/&gt;
  &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
  &lt;wsse:SecurityTokenReference&gt;
  &lt;wsse:Reference URI="#SecurityToken-c0cc2cd4-cb77-4fa5-abfa-bd485afd1685" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/&gt;
  &lt;/wsse:SecurityTokenReference&gt;
  </code></pre>
  
  <p>Although I have the wsdl, this is my code in C# to create custom binding. I am not sure how to use the wsdl to create a soap header.What I know is how to use to invoke some operation.I used svcutil to generate a proxy. Let me know if anyone wants to see the wsdl
  Also, I believe my webconfig  doesn't need any binding configurations. Because I am setting all the binding, endpoints in code</p>
  
  <pre><code>       protected void Button2_Click(object sender, EventArgs e)
          {
          var b = new CustomBinding();
          var sec = (AsymmetricSecurityBindingElement)SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10);
  
              UserNameSecurityTokenParameters tokenParameters = new
                UserNameSecurityTokenParameters();
              tokenParameters.InclusionMode =
                SecurityTokenInclusionMode.AlwaysToRecipient;
              tokenParameters.RequireDerivedKeys = false;
              sec.EndpointSupportingTokenParameters.SignedEncrypted.Add(
                tokenParameters);
          //b.Elements.Add(security);
     //     sec.EndpointSupportingTokenParameters.Signed.Add(new UserNameSecurityTokenParameters());
          sec.MessageSecurityVersion =
              MessageSecurityVersion.
                  WSSecurity10WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10;
          sec.IncludeTimestamp = true;
          sec.MessageProtectionOrder = System.ServiceModel.Security.MessageProtectionOrder.EncryptBeforeSign;
  
          b.Elements.Add(sec);
          b.Elements.Add(new TextMessageEncodingBindingElement(MessageVersion.Soap11, Encoding.UTF8));
          b.Elements.Add(new HttpTransportBindingElement());
  
  
          //AddressHeader addressHeader1 = AddressHeader.CreateAddressHeader("wsse", "http://12.23.28.113:9047/MHService", 1);
          AddressHeader[] addressHeaders = null;
          EndpointAddress endptAddress = new EndpointAddress(new Uri("http://12.23.28.113:9047/MHService"), EndpointIdentity.CreateDnsIdentity("DPMedsHistory"), addressHeaders);
  
          MHSClient serviceProxy = new MHSClient(b, endptAddress);
          serviceProxy.ClientCredentials.UserName.UserName = "sss";
          serviceProxy.ClientCredentials.UserName.Password = "fff";
          serviceProxy.ClientCredentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindBySubjectName, "sss");
          serviceProxy.ClientCredentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.CurrentUser, StoreName.My, X509FindType.FindBySubjectName, "dsfdsa");
  
              byte[] array = Encoding.ASCII.GetBytes("Hi");
          Transaction t = new Transaction();
          t.transData = array;
          serviceProxy.getEligibility(t);
  
      }
  </code></pre>
  
  <p>This is my generated request as per fiddler</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;s:Header&gt;&lt;VsDebuggerCausalityData xmlns="http://schemas.microsoft.com/vstudio/diagnostics/servicemodelsink"&gt;VsDebuggerCausalityData&gt;
  &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
  &lt;u:Timestamp u:Id="uuid-c243958e-b070-4ac7-b497-9f668427eeb9-2"&gt;&lt;u:Created&gt;2013-05-08T17:03:14.129Z&lt;/u:Created&gt;&lt;u:Expires&gt;2013-05-08T17:08:14.129Z&lt;/u:Expires&gt;
  &lt;/u:Timestamp&gt;
  &lt;o:BinarySecurityToken u:Id="uuid-2e5edef4-96b6-4747-83ad-f8b5a34d1ada-6" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" 
  EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"&gt;l81/yYTa2h&lt;/e:CipherValue&gt;&lt;/e:CipherData&gt;&lt;/e:EncryptedData&gt;&lt;/s:Body&gt;&lt;/s:Envelope&gt;
  </code></pre>
  
  <p>Questions: Why is it not generating the usernametoken
  2) How do it get those wsse headers. My external service url uses http </p>