How to pass security token in header of a soap request

Question

I want to pass security token in header of a soap request from c# code as per the sample below

My service url http://nclpwntapp10188.devaonnet.aon.net:9089/ECMGenericWS/v2/ECMGenericWS/ECMGenericWS.wsdl

<soapenv:Envelope xmlns:ecm="http://www.ECMGenericWebService.ecm.aon.com/ECMGenericWS/" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="1">
<wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-8">
<wsse:Username>rrrrr</wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest">test</wsse:Password>
<wsse:Nonce EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">f8nUe3YupTU5ISdCy3X9Gg==</wsse:Nonce>
<wsu:Created>2011-05-04T19:01:40.981Z</wsu:Created>
</wsse:UsernameToken>
</wsse:Security>
</soapenv:Header>

I tried the below solution but it doesn't work for me

How can I pass a username/password in the header to a SOAP WCF Service

Your XML sample is incomplete. It doesn't contain the parent "" element and its namespace, which is probably `xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"` — AlwaysLearning, Jul 25 '19 at 06:02

AlwaysLearning · Answer 1 · 2019-07-25T08:59:16.540

I'm sure there are libraries for this, but if you have access to the raw XML and want to parse it yourself you'll need classes defined like the following:

    [XmlRoot(Namespace = "http://schemas.xmlsoap.org/soap/envelope/")]
    public class Envelope
    {
        [XmlElement(Namespace = "http://schemas.xmlsoap.org/soap/envelope/")]
        public Header Header { get; set; }
    }

    public class Header
    {
        [XmlElement(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")]
        public Security Security { get; set; }
    }

    public class Security
    {
        [XmlAttribute(Namespace = "http://schemas.xmlsoap.org/soap/envelope/")]
        public int mustUnderstand { get; set; }

        [XmlElement(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")]
        public UsernameToken UsernameToken { get; set; }
    }
    public class UsernameToken
    {
        [XmlAttribute(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")]
        public string Id { get; set; }

        public string Username { get; set; }

        public Password Password { get; set; }

        public Nonce Nonce { get; set; }

        [XmlElement(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")]
        public DateTime Created { get; set; }
    }

    public class Password
    {

        [XmlAttribute()]
        public string Type { get; set; }
        [XmlText]
        public string Value { get; set; }
    }

    public class Nonce
    {

        [XmlAttribute()]
        public string EncodingType { get; set; }
        [XmlText]
        public string Value { get; set; }
    }

At which point you can then deserialize it with an XmlSerializer instance, e.g.:

const string xml = "...";
using (var stream = new MemoryStream(Encoding.UTF8.GetBytes(xml)))
{
    var serializer = new XmlSerializer(typeof(Envelope));
    var envelope = (Envelope)serializer.Deserialize(stream);
    // Do stuff with Envelope, Security, UsernameToken, etc here...
}

=====

Edit: Harpreet asked for a complete code sample, so here it is below.

Note that I also added the closing </soapenv:Envelope> tag that was missing from his example XML.

using System;
using System.IO;
using System.Text;
using System.Xml.Serialization;

// REF:
// How to pass security token in header of a soap request
// https://stackoverflow.com/questions/57194919/how-to-pass-security-token-in-header-of-a-soap-request/57195772

namespace Parse_security_token_in_header_of_a_soap_request
{
    [XmlRoot(Namespace = "http://schemas.xmlsoap.org/soap/envelope/")]
    public class Envelope
    {
        [XmlElement(Namespace = "http://schemas.xmlsoap.org/soap/envelope/")]
        public Header Header { get; set; }
    }

    public class Header
    {
        [XmlElement(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")]
        public Security Security { get; set; }
    }

    public class Security
    {
        [XmlAttribute(Namespace = "http://schemas.xmlsoap.org/soap/envelope/")]
        public int mustUnderstand { get; set; }

        [XmlElement(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")]
        public UsernameToken UsernameToken { get; set; }
    }
    public class UsernameToken
    {
        [XmlAttribute(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")]
        public string Id { get; set; }

        public string Username { get; set; }

        public Password Password { get; set; }

        public Nonce Nonce { get; set; }

        [XmlElement(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd")]
        public DateTime Created { get; set; }
    }

    public class Password
    {

        [XmlAttribute()]
        public string Type { get; set; }
        [XmlText]
        public string Value { get; set; }
    }

    public class Nonce
    {

        [XmlAttribute()]
        public string EncodingType { get; set; }
        [XmlText]
        public string Value { get; set; }
    }

    class Program
    {
        const string xml =
            "<soapenv:Envelope xmlns:ecm=\"http://www.ECMGenericWebService.ecm.aon.com/ECMGenericWS/\" xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">\r\n" +
            "<soapenv:Header>\r\n" +
            "<wsse:Security xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" soapenv:mustUnderstand=\"1\">\r\n" +
            "<wsse:UsernameToken xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\" wsu:Id=\"UsernameToken-8\">\r\n" +
            "<wsse:Username>rrrrr</wsse:Username>\r\n" +
            "<wsse:Password Type=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest\" >test</wsse:Password>\r\n" +
            "<wsse:Nonce EncodingType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary\" >f8nUe3YupTU5ISdCy3X9Gg==</wsse:Nonce>\r\n" +
            "<wsu:Created>2011-05-04T19:01:40.981Z</wsu:Created>\r\n" +
            "</wsse:UsernameToken>\r\n" +
            "</wsse:Security>\r\n" +
            "</soapenv:Header>\r\n" +
            "</soapenv:Envelope>\r\n";

        static void Main(string[] args)
        {
            using (var stream = new MemoryStream(Encoding.UTF8.GetBytes(xml)))
            {
                var serializer = new XmlSerializer(typeof(Envelope));
                var envelope = (Envelope)serializer.Deserialize(stream);
                // Do stuff with Envelope here...
                Console.WriteLine(envelope);
            }
        }
    }
}

Can you please provide me the sample code as I am not able to execute the above code — Harpreet, Jul 25 '19 at 08:13
@Harpreet Will be a minute, need to RDP back into work. It's not much more than a `main()` declaration, a `namespace` declaration and a few `using` statements. — AlwaysLearning, Jul 25 '19 at 08:53

How to pass security token in header of a soap request

1 Answers1