An error occurred when verifying security for the message

Question

When I try to call a WCF service I am getting the following message "An error occurred when verifying security for the message."

When I remove the custom authenication the service works no problem. I can't figure out though what I have misconfigured in my web.config. Any insight would be appreciated.

  <system.serviceModel>
     <services>
        <service behaviorConfiguration="NAThriveExtensions.nableAPIBehavior"
          name="NAThriveExtensions.nableAPI">
           <endpoint 
             address="" 
             binding="basicHttpBinding" 
             bindingConfiguration="basicHttpBinding_Secure"
             contract="NAThriveExtensions.InableAPI">
           </endpoint>
           <endpoint 
             address="mex" 
             binding="mexHttpsBinding" 
             contract="IMetadataExchange" />
        </service>
     </services>
     <behaviors>
        <serviceBehaviors>
          <behavior name="NAThriveExtensions.nableAPIBehavior">
            <serviceMetadata httpsGetEnabled="true" />
            <serviceDebug includeExceptionDetailInFaults="false" />
            <serviceCredentials>
              <userNameAuthentication 
                userNamePasswordValidationMode="Custom" 
              customUserNamePasswordValidatorType= "NAThriveExtensions.Authentication, NAThriveExtensions" />
            </serviceCredentials>
          </behavior>
        </serviceBehaviors>
     </behaviors>
     <bindings>
       <basicHttpBinding>
         <binding name="basicHttpBinding_Secure">
           <security mode="TransportWithMessageCredential">
             <message clientCredentialType="UserName"/>
           </security>
         </binding>
       </basicHttpBinding>
     </bindings>
  </system.serviceModel>

score 40 · Answer 1 · answered Mar 07 '13 at 23:10

I was getting this same error message and it turned out to be due to a time difference between my workstation machine and the server hosting the WCF service. The server was about 10 minutes behind my machine and WCF security doesn't seem to like that very much.

To find the root problem I turned on serviceSecurityAuditing in the server's config file. Add the following to the configuration/system.serviceModel/behaviors/serviceBehaviors/behavior section for your service:

<serviceSecurityAudit 
    auditLogLocation="Application" 
    serviceAuthorizationAuditLevel="Failure" 
    messageAuthenticationAuditLevel="Failure" 
    suppressAuditFailure="true"/>

The following site was helpful in figuring this out:

http://blogs.microsoft.co.il/blogs/urig/archive/2011/01/23/wcf-quot-an-error-occurred-when-verifying-security-for-the-message-quot-and-service-security-audit.aspx

This really is a great tip. It appeared I was missing a DLL, like described here: http://stackoverflow.com/questions/14033193/entity-framework-provider-type-could-not-be-loaded#comment29085393_15358941 — ArieKanarie, Mar 29 '17 at 09:20
I wish I could upvote this more than once! Half a day trying to get the real error message. — L_7337, Apr 10 '17 at 18:31

score 19 · Answer 2 · answered Jan 31 '14 at 16:30

19

Another cause of this message is when some of your machines are not synchronized in time. WCF, by default, allows a five-minute gap; beyond this, it throws an error if things are out of synch.

The solution is to synch all your machines. time.windows.com is notorious for not working, so I suggest using something else. (If you're in a corporate environment, a local domain controller may be the correct choice here.)

answered Jan 31 '14 at 16:30

ashes999

9,462
13
66
117

4

Thank you so much! I was pulling my hair out wondering what this issue was!! – CaptainStealthy Sep 12 '14 at 21:46
Glad it's not just me @Stealth22 :) – ashes999 Sep 12 '14 at 21:49
3

My server and client were at the same clock. Client clock automatically configured but server clock was manually set. I activated "Set time automatically" on the server and problem solved. – Oktay Nov 24 '16 at 08:43

score 7 · Accepted Answer · answered Oct 08 '10 at 16:24

7

This ended up being an problem on the consuming side, not with the service itself. Software AG's webMethods 8 was consuming this server but there was no Security Handler added to the service so the credentials were not being added to the header thus resulting the in the aforementioned error.

answered Oct 08 '10 at 16:24

Matt Klepeis

1,684
1
13
25

5

How could one find out if this is indeed the problem? – Maritim Jan 04 '13 at 14:50
@Maritim: Good question. Looking at the raw HTTP request is the best way I know - e.g. by logging it if it is not already being logged: the missing (elements of the) SOAP header should then be apparent. – J0e3gan Aug 01 '14 at 23:12

score 1 · Answer 4 · answered Mar 17 '19 at 20:42

I had a similar issue. I was building my datetime formatted strings using my local time, but my service/server was expecting GMT.

I needed to get the GMT time (JAVA):

final Date currentTime = new Date();    
final SimpleDateFormat sdf = 
new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss'.000Z'");
sdf.setTimeZone(TimeZone.getTimeZone("GMT"));
System.out.println(sdf.format(currentTime));

score 0 · Answer 5 · answered Apr 08 '13 at 05:57

I was getting the same error on my IIS 7.5 server. I forgot to add Read permission on the certificate's private key to the app pool virtual account (e.g. IIS AppPool\ASP.NET v4.0).

For info, whilst testing various combinations of accounts and permissions, I noticed that the app pool needed to be recycled to lose access to the key, once it had been retrieved once.

(0x80131501 - An error occurred when verifying security for the message.)

score 0 · Answer 6 · answered Sep 06 '16 at 12:30

I was getting the same error and none of the above help for me.

I finally tracked it down to connectionStrings in a parent web.config (my service was deployed to a child application to an admin site).

Yes sounds ridiculous, but as soon as I wrapped the connection strings in the parent web.config with a location element all started working.

For clarity, in parent web.config, I changed this

<connectionStrings>
    <add name="..." />
</connectionStrings>

to this

<location path="." inheritInChildApplications="false">
    <connectionStrings>
        <add name="..." />
    </connectionStrings>
</location>

Note this error also resulted in this very unhelpful serviceSecurityAudit log message:

Message authentication failed.
Service: ...
Action: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
ClientIdentity:
ActivityId:
ArgumentNullException: Value cannot be null.
Parameter name: manager

score 0 · Answer 7 · edited Jun 20 '20 at 09:12

I was getting the same error. I forgot to add Read permission on the membership database aspnetdb to the (IIS APPPOOL\DefaultAppPool).

Message authentication failed. Service:....

Action: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT

ClientIdentity:

ActivityId:

SqlException: Cannot open database "aspnetdb" requested by the login. The login failed.

Login failed for user 'IIS APPPOOL\DefaultAppPool'.

score -4 · Answer 8 · answered Dec 23 '15 at 09:05

-4

The username and password is the server you connection,not your system login username and password.

answered Dec 23 '15 at 09:05

MapleStory

480
2
9
20

An error occurred when verifying security for the message

8 Answers8

Linked