Wse3 through firewall (WSE816)

Phil Lee · Joined: 08 Aug 2007 Posts: 13

Hi,

We have a client application communicating with a WSE3 web service
configured for username over certificate.

Out customer tried to configure the client on one side of a firewall, with
the firewall making the server visible as say address 66.55.44.33:80001 and
the server internal to the firewall on say address 10.10.10.10:80.

The client app then fails with:
Destination Unreachable, WSE816: The header must match the value of an
incoming message's HTTP Request Url if the soap receiver does not have an
actor name.
The header received contained http://66.55.44.33:8001/.. while the HTTP
Request Url was http://66.55.44.33/....

There is some info on the web about setting Actor name and using end points
but nothing very clear.

Is there a recommended way to configure web.config for this scenario?

Regards
Phil Lee

Archived from group: microsoft>public>dotnet>framework>webservices>enhancements

Phil Lee · Joined: 08 Aug 2007 Posts: 13

Steven,

many thanks as usual.

I think your diagnosis is correct. I have more to go on now certainly.
Using the SoapActor attribute would potentially require a special build for
each customer.
Can this be done through configuration or by setting a property value?

Regards,
Phil Lee

"Steven Cheng[MSFT]" wrote in message
news:$oyjMXvhHHA.2164@TK2MSFTNGHUB02.phx.gbl...
> Hi Phil,
>
> From your description, your WSE service application is deployed behind the
> firewall and exposed through a public address and port(which client
> application will communicate against), and the firewall will forward the
> webservice messages to internal address/port, however, you 're getting the
> "Destination Unreachable, WSE816: ........" exception at runtime, correct?
>
> Based on my understanding, the problem is just as the error message
> indicate, the WS-Addressing header's value doesn't match the uri in
> the http request's url value. When you use a firewall or proxy/redirector
> between your service and client. The Client will send the httprequest
> using
> the proxy/firewall's url, while at server-side, the WSE runtime will check
> the http message's url againt the WS-Addressing's header(if you do
> not
> supply a "Action" for the service, this will mismatch(since you're using
> proxy/redirector). One way to resolve this is explicitly apply a
> SoapActor
> for the server service through "SoapActor" attribute. e.g.
>
> #8080 is a proxy/redirector's port while my service is actually listening
> on another port, for your scenario, you should replace the "SoapActor"
> value to your firewall's opened public address:
> ============================
> [WebService(Namespace = "http://tempuri.org/")]
> [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
> [Policy("ServicePolicy")]
> [SoapActor("http://localhost:8080/WSE3Service/Service.asmx")]
> public class Service : System.Web.Services.WebService
> {
> ========================
>
> the following reference also describe the usage of SoapActorAttribute:
>
> #SoapActorAttribute Class
> http://msdn2.microsoft.com/en-us/library/microsoft.web.services3.messaging.s
> oapactorattribute.aspx
>
> In addition, for formal distributed webservice deployed between enterprise
> security boundary, you're recommended to setup a centeral service
> router(public to external clients) which will be able to directly access
> internal servers(so that the client messages can be router to the
> desination server). Here are some reference on this:
>
> #Perimeter Service Router
> http://msdn2.microsoft.com/en-us/library/aa480606.aspx
>
> #Implementing Perimeter Service Router in WSE 3.0
> http://msdn2.microsoft.com/en-us/library/aa480601.aspx
>
> #Routing SOAP Messages with WSE
> http://msdn2.microsoft.com/en-us/library/aa529328.aspx
>
>
> Sincerely,
>
> Steven Cheng
>
> Microsoft MSDN Online Support Lead
>
>
>
> ==================================================
>
> Get notification to my posts through email? Please refer to
> http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
> ications.
>
>
>
> Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> where an initial response from the community or a Microsoft Support
> Engineer within 1 business day is acceptable. Please note that each follow
> up response may take approximately 2 business days as the support
> professional working with you may need further investigation to reach the
> most efficient resolution. The offering is not appropriate for situations
> that require urgent, real-time or phone-based interactions or complex
> project analysis and dump analysis issues. Issues of this nature are best
> handled working with a dedicated Microsoft Support Engineer by contacting
> Microsoft Customer Support Services (CSS) at
> http://msdn.microsoft.com/subscriptions/support/default.aspx.
>
> ==================================================
>
>
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>

Phil Lee · Joined: 08 Aug 2007 Posts: 13

Steven,

ok, that's a shame, but thanks for you help.

Phil
"Steven Cheng[MSFT]" wrote in message @TK2MSFTNGHUB02.phx.gbl...
> Hi Phil,
>
> Sorry for keep you waiting. As for the "SoapActor" setting, I've discussed
> with some WSE team's engineers and they have confirmed that this is not
> supported to set programmatically at runtime. We may have to configure it
> statically.
>
> Anyway, if there is anything else need help, please feel free to post
> here.
>
> Sincerely,
>
> Steven Cheng
>
> Microsoft MSDN Online Support Lead
>
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.

Problem with WSE3.0 x509 I have a c# windows forms app that utilizes service oriented architecture. Both the client and service are configured using WSE3.0 using x509 certificates. I am using Windows 2003 Certificate Server configured as standalone to generate the certificates. I

$1,000 for a prompt fix for this WSE3 issue Yes, I'm stuck and against the clock badly. I really will pay the first person who fixes this issue $1,000 (or whatever your local currency equivalent is), but I need the answer tonight!! I have a simple Dotnet 2.0 application which is using WSE 3.0 to co

WSE3 ReadElementContentAsBinHex raises NotImplementedExcepti When attempting to retrieve an element of type hexBinary that is part of a complex type I get: There is an error in the XML document. The method or operation is not implemented. at Microsof

WSE3 web farm problem: "Key not valid for use in specified s I have a web service in ASP.NET 2.0 and WSE 3.0. It worked fine until I setup a web farm with a hardware load balancer. The error I received is "Key not valid for use in specified state". However, If I connect directly without going through load balanc

WSE3 (and MTOM?) - Permissions Issue Hi All I am getting the following error from the web service, but only when the web service is in an account that is not in the group, but this is not an ideal long-term solution. Unhandled Exception: WSE839: An HTTP