Phidiax Tech Blog

Background

Recently I was tasked with enriching a WCF web service to supply the originating client Windows Authenticated credentials through to BizTalk for further processing. This is exposed to the public domain and many types of clients may connect, so SSL and the basicHTTPbinding was the preferred approach.

The environment is: BizTalk 2013 R2, .Net 4.0, WCF, SoapUI

How To

Option 1: Here is an approach, which is very cool, yet, not optimal. Read this, then we can get to the easier quick fix.

Traditionally, WCF encrypts the messaging context and much of the HTTP detail becomes unavailable by the time the message reaches BizTalk. A suggested approach would be to create a custom WCF EndPointBehavior or ServiceBahavior. A WCF Custom Behavior solution like this would allow inspection (MessageInspector) of messages within the WCF pipeline, and push certain detail into the WCF Http Headers, which would result in BizTalk having these details in the message context of the InboundHeaders property. Hence, you could rip these properties and use them during processing.

Dean May has a great approach towards this: Securing BizTalk WCF Receive Locations

Option 2: So, now for the easier quick fix.

Nevertheless, there is a much easier way to do this, by utilizing the tools that we are given.

Create the WCF Service on IIS

1. This could be by traditional means, WCF Publisher, etc.
2. Update the Authentication properties for the WCF Service
1. Disable all methods
2. Enable Windows Authentication
3. Update the SSL Settings
1. Require SSL
2. Accept Client Certs 

Create a new AppPool

1. Connect your WCF Service to utilize the newly created AppPool
2. The AppPool should be configured for:
3. .Net Framework v4
4. Integrated pipeline

BizTalk Receive Port Configuration

1. Be sure to utilize the WCF-CustomIsolated Adapter
2. Select the basicHttpBinding
3. Ensure Security is set to Transport
4. Ensure Transport clientCredentialType is set to Windows
5. All other defaults are acceptable

Test with SoapUI

1. Be sure to create a new project, and point to your WCF Service
2. Before submitting your message set the Auth properties

Verification with BizTalk