Share via

<secureConversationBootstrap>

  • Article

Specifies the default values used for initiating a secure conversation service.

<system.serviceModel>

  <bindings>

    <customBinding>

      <binding>

        <security> of <customBinding>

          <secureConversationBootstrap>

                                    
                                    <secureConversationBootstrap
                                
                                    
                                       allowSerializedSigningTokenOnReply="Boolean"
                                
                                    
                                       authenticationMode="AuthenticationMode"
                                
                                    
                                       defaultAlgorithmSuite="SecurityAlgorithmSuite"
                                
                                    
                                       includeTimestamp="Boolean"
                                
                                    
                                       requireDerivedKeys="Boolean"
                                
                                    
                                       keyEntropyMode="ClientEntropy/ServerEntropy/CombinedEntropy" 
                                
                                    
                                    messageProtectionOrder="SignBeforeEncrypt/SignBeforeEncryptAndEncryptSignature/EncryptBeforeSign"
                                
                                    
                                       messageSecurityVersion="WSSecurityJan2004/WSSecurityXXX2005"
                                
                                    
                                       requireDerivedKeys="Boolean"
                                
                                    
                                       requireSecurityContextCancellation="Boolean"
                                
                                    
                                       requireSignatureConfirmation="Boolean" >
                                
                                    
                                       securityHeaderLayout="Strict/Lax/LaxTimestampFirst/LaxTimestampLast"
                                
                                    
                                       includeTimestamp="Boolean" />

Type

Attributes and Elements

The following sections describe attributes, child elements, and parent elements.

Attributes

Attribute Description

allowSerializedSigningTokenOnReply

A Boolean value that specifies whether a serialized token can be used on reply.

authenticationMode

Specifies the SOAP authentication mode used between the initiator and the responder.

The default is sspiNegotiated.

This attribute is of type AuthenticationMode.

defaultAlgorithmSuite

Security algorithm suite defines of a variety of algorithms such as Canonicalization, Digest, KeyWrap, Signature, Encryption, and KeyDerivation algorithms. Each of the security algorithm suites defines values for these different parameters. Message-based security is achieved using these algorithms.

This attribute is used when working with a different platform that opts for a set of algorithms different than the default. You should be aware of the strengths and weaknesses of the relevant algorithms when making modifications to this setting. This attribute is of type SecurityAlgorithmSuite. The default is Aes256.

includeTimestamp

A Boolean value that specifies whether time stamps are included in each message. The default is true.

keyEntropyMode

Specifies the way that keys for securing messages are computed. Keys can be based on the client key material only, on the service key material only or a combination of both. Valid values are:

  • ClientEntropy: The session key is based off the client provided key material.

  • ServerEntropy: The session key is based off the service provided key material.

  • CombinedEntropy: The session key is based off the client and service provided keying material.

The default is CombinedEntropy.

This attribute is of type SecurityKeyEntropyMode.

messageProtectionOrder

Sets the order in which message level security algorithms are applied to the message. Valid values include the following:

  • SignBeforeEncrypt: Sign first, then encrypt.

  • SignBeforeEncryptAndEncryptSignature: Sign, encrypt, and encrypt signature.

  • EncryptBeforeSign: Encrypt first, then sign.

The default is SignBeforeEncrypt.

This attribute is of type MessageProtectionOrder.

messageSecurityVersion

Sets the version of WS-Security that is used. Valid values include the following:

  • WSSecurityJan2004

  • WSSecurityXXX2005

The default is WSSecurityXXX2005. This attribute is of type MessageSecurityVersion.

requireDerivedKeys

A Boolean value that specifies whether keys can be derived from the original proof keys. The default is true.

requireSecurityContextCancellation

A Boolean value that specifies whether security context should be cancelled and terminated when it is no longer required. The default is true.

requireSignatureConfirmation

A Boolean value that specifies whether WS-Security signature confirmation is enabled. When set to true, message signatures are confirmed by the responder. The default is false.

Signature confirmation is used to confirm that the service is responding in full awareness of a request.

securityHeaderLayout

Specifies the ordering of the elements in security header. Valid values are:

  • Strict. Items are added to the security header according to the general principle of “declare before use”.

  • Lax. Items are added to the security header in any order that confirms to WSS: SOAP Message security.

  • LaxWithTimestampFirst. Items are added to the security header in any order that confirms to WSS: SOAP Message security except that the first element in the security header must be a wsse:Timestamp element.

  • LaxWithTimestampLast. Items are added to the security header in any order that confirms to WSS: SOAP Message security except that the last element in the security header must be a wsse:Timestamp element.

The default is Strict.

This element is of type SecurityHeaderLayout.

Child Elements

Element Description

<issuedTokenParameters>

Specifies a current issued token. This element is of type IssuedTokenParametersElement.

localClientSettings element

Specifies the security settings of a local client for this binding. This element is of type LocalClientSecuritySettingsElement.

localServiceSettings element

Specifies the security settings of a local service for this binding. This element is of type LocalServiceSecuritySettingsElement.

Parent Elements

Element Description

<security> of <customBinding>

Specifies the security options for a custom binding.

Footer image

Send comments about this topic to Microsoft.
© Microsoft Corporation. All rights reserved.