Tim Mackey's Weblog

Note: this doesn't really work..

i'm just leaving it here for interest.  the approach will work for the first invocation of either v2 or v3 client, but after a v2 client has used the web service, any v3 clients will fail.  MS told me this is not supported because of the 2 soapExtensions interfere with each other in the pipeline etc

---

My asp.net CMS has some winforms clients running WSE2, and i'm doing an upgrade to the client (and server) to use WSE3, but i want to support both versions.  Both WSE2 and WSE3 clients are using a CustomUsernameTokenManager.  it was a bit tricky to work out, but here is what i ended up doing. thanks to brian o'keefe for his newsgroup post for most of the answer.  Your exact config might vary but hopefully it will save you some of the hassle of working all this out.

• Leave the existing web service in place, e.g. Service_WSE2.asmx
  
• Create a new web service for the WSE3 client, essentially copy/paste the ASMX file, e.g. Service_WSE3.asmx
• Create a new CustomUsernameTokenManager for the WSE3 service which inherits from Microsoft.Web.Services3.Security.Tokens.UsernameTokenManager.  In my case it was as easy as copy/paste from the WSE2 token manager and change all the WSE2 namespaces to WSE3.
  
• then in web.config, make sure both WSE config sections are listed:
  

  <configuration>
  	<configSections>
  		<section name="microsoft.web.services3" type="Microsoft.Web.Services3.Configuration.WebServicesConfiguration, Microsoft.Web.Services3,Version=3.0.0.0,Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  		<section name="microsoft.web.services2" type="Microsoft.Web.Services2.Configuration.WebServicesConfiguration, Microsoft.Web.Services2, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  	</configSections>
  

• add in references to both the assemblies for the compilation section (not 100% sure if this is necessary, but at least it means the app will not compile on the production server if you forget to deploy either of the WSE assemblies, instead of waiting till one of your clients connects).
  

  	<compilation defaultLanguage="c#" debug="true">
  		<assemblies>
  			<add assembly="Microsoft.Web.Services2, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
  			<add assembly="Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>

• remove the <webServices> section from <system.web>, because each web service should be configured by location, not global as this interferes.
  

  	<location path="Service_WSE2.asmx">
  		<system.web>
  			<webServices>
  				<soapExtensionTypes>
  					<add type="Microsoft.Web.Services2.WebServicesExtension, Microsoft.Web.Services2, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" priority="1" group="0" />
  				</soapExtensionTypes>				
  			</webServices>
  		</system.web>
  	</location>
  	
  	<location path="Service_WSE3.asmx">
  		<system.web>
  			<webServices>
  				<soapExtensionTypes>
  					<clear/>
  				</soapExtensionTypes>
  				<soapServerProtocolFactory type="Microsoft.Web.Services3.WseProtocolFactory, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
  				<soapExtensionImporterTypes>
  					<add type="Microsoft.Web.Services3.Description.WseExtensionImporter, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
  				</soapExtensionImporterTypes>				
  			</webServices>
  		</system.web>
  	</location>

• my webservice policy are defined in policyCache.config files, so the following web.config sections point each version of WSE to the right file:
  

  	<microsoft.web.services3>
  		<policy fileName="policyCache_WSE3.config"/>
  		<security>
  			<securityTokenManager>
  				<add type="Whatever.CustomUsernameTokenManager3" namespace="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" localName="UsernameToken"/>
  			</securityTokenManager>
  		</security>
  	</microsoft.web.services3>
  	<microsoft.web.services2>
  		<messaging>
  			<maxRequestLength>10000</maxRequestLength>
  		</messaging>
  		<security>
  			<securityTokenManager type="Whatever.CustomUsernameTokenManager2, MyAssemblyName" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
  				qname="wsse:UsernameToken" />
  			<defaultTtlInSeconds>86400</defaultTtlInSeconds>
  			<timeToleranceInSeconds>86400</timeToleranceInSeconds>
  		</security>
  		<policy>
  			<cache name="policyCache_WSE2.config" />
  		</policy>
  	</microsoft.web.services2>

• and lastly, the policy cache files themselves:
  WSE 3 version
  

  <?xml version="1.0"?>
  <policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
  	<extensions>
  		<extension name="usernameOverTransportSecurity" type="Microsoft.Web.Services3.Design.UsernameOverTransportAssertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  		<extension name="requireActionHeader" type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion, Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  	</extensions>
  	<policy name="usernameTokenSecurity">		
  		<usernameOverTransportSecurity />
  		<requireActionHeader />
  	</policy>
  </policies>

• WSE 2 version
  

  <?xml version="1.0"?>
  <policyDocument xmlns:wse="http://schemas.microsoft.com/wse/2003/06/Policy" xmlns="http://schemas.microsoft.com/wse/2003/06/Policy">
  	<mappings xmlns:wse="http://schemas.microsoft.com/wse/2003/06/Policy">
  
  		<endpoint uri="http://localhost/Service_WSE2.asmx">
  			<defaultOperation>
  				<request policy="#username-token-signed" />
  				<response policy="" />
  				<fault policy="" />
  			</defaultOperation>
  		</endpoint>
  
  		<defaultEndpoint>
  			<defaultOperation>
  				<request policy="" />
  				<response policy="" />
  				<fault policy="" />
  			</defaultOperation>
  		</defaultEndpoint>
  
  	</mappings>
  	<policies xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
  		<wsp:Policy wsu:Id="username-token-signed" xmlns:wsp="http://schemas.xmlsoap.org/ws/2002/12/policy" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/03/addressing" xmlns:wssp="http://schemas.xmlsoap.org/ws/2002/12/secext">
  			<wsp:MessagePredicate wsp:Usage="wsp:Required" Dialect="http://schemas.xmlsoap.org/2002/12/wsse#part">
  				wsp:Body() wsp:Header(wsa:To) wsp:Header(wsa:Action) wsp:Header(wsa:MessageID) wse:Timestamp()
  			</wsp:MessagePredicate>
  			<wssp:Integrity wsp:Usage="wsp:Required">
  				<wssp:TokenInfo>
  					<SecurityToken xmlns="http://schemas.xmlsoap.org/ws/2002/12/secext">
  						<wssp:TokenType>http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#UsernameToken</wssp:TokenType>
  						<wssp:Claims>
  							<wssp:UsePassword wsp:Usage="wsp:Required" />
  						</wssp:Claims>
  					</SecurityToken>
  				</wssp:TokenInfo>
  				<wssp:MessageParts Dialect="http://schemas.xmlsoap.org/2002/12/wsse#part">
  					wsp:Body() wsp:Header(wsa:Action) wsp:Header(wsa:FaultTo) wsp:Header(wsa:From) wsp:Header(wsa:MessageID) wsp:Header(wsa:RelatesTo) wsp:Header(wsa:ReplyTo) wsp:Header(wsa:To)  wse:Timestamp()
  				</wssp:MessageParts>
  			</wssp:Integrity>
  		</wsp:Policy>
  	</policies>
  </policyDocument>