How to: Set a Max Clock Skew

Article
08/07/2009

Time-critical functions can be derailed if the clock settings on two computers are different. To mitigate this possibility, you can set the MaxClockSkew property to a TimeSpan. This property is available on two classes:

LocalClientSecuritySettings

LocalServiceSecuritySettings


Important For a secure conversation, changes to the MaxClockSkew property must be made when the service or client is bootstrapped. To do this, you must set the property on the SecurityBindingElementreturned by the BootstrapSecurityBindingElement.

To change the property on one of the system-provided bindings, you must find the security binding element in the collection of bindings and set the MaxClockSkew property to a new value. Two classes derive from the SecurityBindingElement: SymmetricSecurityBindingElement and AsymmetricSecurityBindingElement. When retrieving the security binding from the collection, you must cast to one of these types in order to correctly set the MaxClockSkew property. The following example uses a WSHttpBinding, which uses the SymmetricSecurityBindingElement. For a list that specifies which type of security binding to use in each system-provided binding, see System-Provided Bindings.

To create a custom binding with a new clock skew value in code


Note Add references to the following namespaces in your code: System.ServiceModel.Channels, System.ServiceModel.Description, System.Security.Permissions, and System.ServiceModel.Security.Tokens.

Create an instance of a WSHttpBinding class and set its security mode to Message.

Create a new instance of the BindingElementCollection class by calling the CreateBindingElements method.
Use the Find method of the BindingElementCollection class to find the security binding element.
When using the Find method, cast to the actual type. The example below casts to the SymmetricSecurityBindingElement type.
Set the MaxClockSkew property on the security binding element.
Create a ServiceHost with an appropriate service type and base address.

Use the AddServiceEndpoint method to add an endpoint and include the CustomBinding.

' This method returns a custom binding created from a WSHttpBinding. Alter the method 
' to use the appropriate binding for your service, with the appropriate settings.
Public Shared Function CreateCustomBinding(ByVal clockSkew As TimeSpan) As Binding

    Dim standardBinding As WSHttpBinding = New WSHttpBinding(SecurityMode.Message, True)
    Dim myCustomBinding As CustomBinding = New CustomBinding(standardBinding)
    Dim security As SymmetricSecurityBindingElement = _
        myCustomBinding.Elements.Find(Of SymmetricSecurityBindingElement)()
    security.LocalClientSettings.MaxClockSkew = clockSkew
    security.LocalServiceSettings.MaxClockSkew = clockSkew
    ' Get the System.ServiceModel.Security.Tokens.SecureConversationSecurityTokenParameters 
    Dim secureTokenParams As SecureConversationSecurityTokenParameters = _
         CType(security.ProtectionTokenParameters, SecureConversationSecurityTokenParameters)
    ' From the collection, get the bootstrap element.
    Dim bootstrap As SecurityBindingElement = secureTokenParams.BootstrapSecurityBindingElement
    ' Set the MaxClockSkew on the bootstrap element.
    bootstrap.LocalClientSettings.MaxClockSkew = clockSkew
    bootstrap.LocalServiceSettings.MaxClockSkew = clockSkew
    Return myCustomBinding
End Function

Private Sub Run()

    ' Create a custom binding using the method defined above. The MaxClockSkew is set to 30 minutes. 
    Dim customBinding As Binding = CreateCustomBinding(TimeSpan.FromMinutes(30))

    ' Create a ServiceHost instance, and add a metadata endpoint.
    ' NOTE  When using Visual Studio, you must run as administrator.
    Dim baseUri As New Uri("https://localhost:1008/")
    Dim sh As New ServiceHost(GetType(Calculator), baseUri)

    ' Optional. Add a metadata endpoint. The method is defined below.
    AddMetadataEndpoint(sh)

    ' Add an endpoint using the binding, and open the service.
    sh.AddServiceEndpoint(GetType(ICalculator), customBinding, "myCalculator")

    sh.Open()
    Console.WriteLine("Listening...")
    Console.ReadLine()
End Sub

Private Sub AddMetadataEndpoint(ByRef sh As ServiceHost)

    Dim mex As New Uri("https://localhost:1011/metadata/")
    Dim sm As New ServiceMetadataBehavior()
    sm.HttpGetEnabled = True
    sm.HttpGetUrl = mex
    sh.Description.Behaviors.Add(sm)
End Sub

// This method returns a custom binding created from a WSHttpBinding. Alter the method 
// to use the appropriate binding for your service, with the appropriate settings.
public static Binding CreateCustomBinding(TimeSpan clockSkew)
{
    WSHttpBinding standardBinding = new WSHttpBinding(SecurityMode.Message, true);
    CustomBinding myCustomBinding = new CustomBinding(standardBinding);
    SymmetricSecurityBindingElement security =
        myCustomBinding.Elements.Find<SymmetricSecurityBindingElement>();
    security.LocalClientSettings.MaxClockSkew = clockSkew;
    security.LocalServiceSettings.MaxClockSkew = clockSkew;
    // Get the System.ServiceModel.Security.Tokens.SecureConversationSecurityTokenParameters 
    SecureConversationSecurityTokenParameters secureTokenParams =
        (SecureConversationSecurityTokenParameters)security.ProtectionTokenParameters;
    // From the collection, get the bootstrap element.
    SecurityBindingElement bootstrap = secureTokenParams.BootstrapSecurityBindingElement;
    // Set the MaxClockSkew on the bootstrap element.
    bootstrap.LocalClientSettings.MaxClockSkew = clockSkew;
    bootstrap.LocalServiceSettings.MaxClockSkew = clockSkew;
    return myCustomBinding;
}

private void Run()
{
    // Create a custom binding using the method defined above. The MaxClockSkew is set to 30 minutes. 
    Binding customBinding= CreateCustomBinding(TimeSpan.FromMinutes(30));

    // Create a ServiceHost instance, and add a metadata endpoint.
    // NOTE  When using Visual Studio, you must run as administrator.
    Uri baseUri = new Uri("https://localhost:1008/");
    ServiceHost sh = new ServiceHost(typeof(Calculator), baseUri);

    // Optional. Add a metadata endpoint. The method is defined below.
    AddMetadataEndpoint(ref sh);

    // Add an endpoint using the binding, and open the service.
    sh.AddServiceEndpoint(typeof(ICalculator), customBinding, "myCalculator");

    sh.Open();
    Console.WriteLine("Listening...");
    Console.ReadLine();
}

private void AddMetadataEndpoint(ref ServiceHost sh)
{
    Uri mex = new Uri(@"https://localhost:1001/metadata/");
    ServiceMetadataBehavior sm = new ServiceMetadataBehavior();
    sm.HttpGetEnabled = true;
    sm.HttpGetUrl = mex;
    sh.Description.Behaviors.Add(sm);
}

To set the MaxClockSkew in configuration

Create a customBinding Element in the <Bindings> element section.
Create a <binding> element and set the name attribute to an appropriate value. The following example sets it to MaxClockSkewBinding.
Add an encoding element. The example below adds a textMessageEncoding element.
Add a security Element of customBinding element and set the authenticationMode attribute to an appropriate setting. The following example set the attribute to Kerberos to specify that the service use Windows authentication.
Add a localServiceSettings element and set the maxClockSkew attribute to a value in the form of "##:##:##". The following example sets it to 7 minutes. Optionally, add a localServiceSettings element and set the maxClockSkew attribute to an appropriate setting.
Add a transport element. The following example uses an httpTransport element.

For a secure conversation, the security settings must occur at the bootstrap in the secureConversationBootstrap element.

<bindings>
  <customBinding>
    <binding name="MaxClockSkewBinding">
        <textMessageEncoding />
        <security authenticationMode="Kerberos">
           <localClientSettings maxClockSkew="00:07:00" />
           <localServiceSettings maxClockSkew="00:07:00" />
           <secureConversationBootstrap>
              <localClientSettings maxClockSkew="00:30:00" />
              <localServiceSettings maxClockSkew="00:30:00" />
           </secureConversationBootstrap>
        </security>
        <httpTransport />
    </binding>
  </customBinding>
</bindings>

Share via

How to: Set a Max Clock Skew

To create a custom binding with a new clock skew value in code

To set the MaxClockSkew in configuration

See Also

Reference

Concepts

Additional resources