TechBubbles Microsoft Technology BLOG

Verify SOAP Messages Signed using Username and Password

To validate digital signatures for incoming SOAP Messages created using Username Token, WSE Must be configured.

The following procedure explains how to configure a WSE to validate digital signatures created using Username Token.

1. Start Visual studio 2005

2. File Menu, New then click Project.

3. Select ASP.NET Web Service in  the templates pane.

4. Add a reference to the Microsoft.Web.Services3 assembly.

5. In the Web.config file include the <SoapServerProtocolFactory> element in <webServices> section.

 Version=, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />

  Write the following code to validate the SOAP Message

protected override string AuthenticateToken(UsernameToken userName)
    // Ensure that the SOAP message sender passed a UsernameToken.
    if (userName == null)
        throw new ArgumentNullException();

    // This is a very simple provider.
    // In most production systems the following code 
    // typically consults an external database of (userName,hash)
    // pairs. For this example, it is the UTF-8
    // encoding of the user name.
    byte[] password =
    Array.Reverse( password );

    return Convert.ToBase64String( password );

public override void  ValidateMessageSecurity(SoapEnvelope envelope, Security security)
bool IsSigned = false;
foreach (ISecurityElement element in security.Elements)
    if (element is MessageSignature)
        // The given context contains a Signature element.
        MessageSignature sign = element as MessageSignature;

        SignatureOptions expectedOptions = 
             SignatureOptions.IncludeTimestamp |
             SignatureOptions.IncludeSoapBody |
             SignatureOptions.IncludeTo |
             SignatureOptions.IncludeAction |
        if ((sign.SignatureOptions & expectedOptions)==expectedOptions)
            // The SOAP message is signed.
            if (sign.SigningToken is UsernameToken)
                // The SOAP message is signed 
                // with a UsernameToken.
                IsSigned = true;
if (!IsSigned)
    throw new SecurityFault("Message did not meet
 security requirements.");

About the author

Kalyan Bandarupalli

My name is kalyan, I am a software architect and builds the applications using Microsoft .NET technologies. Here I am trying to share what I feel and what I think with whoever comes along wandering to Internet home of mine.I hope that this page and its contents will speak for me and that is the reason I am not going to say anything specially about my self here.


TechBubbles Microsoft Technology BLOG

Follow me


Tag Cloud