The security context token is expired or is not valid (During a SOAP Login)

MIP
, ,
1

I am trying to login to an Essential+ (C-Code) with disabled encryption through protocol integration. Find the HTTP request below:

POST /ManagementServer/ServerCommandService.svc HTTP/1.1

Host: 192.168.0.57

Content-Type: application/soap+xml

User-Agent: PostmanRuntime/7.20.1

Accept: */*

Cache-Control: no-cache

Postman-Token: cff2cc35-e0fd-4633-b1b3-01aa0f6a9715,1bcda6a7-9dd8-407f-bf21-42d18d75ed9a

Host: 192.168.0.57

Accept-Encoding: gzip, deflate

Content-Length: 1358

Connection: keep-alive

cache-control: no-cache

<?xml version="1.0" encoding="UTF-8"?>

<SOAP-ENV:Envelope

xmlns:SOAP-ENV=“http://www.w3.org/2003/05/soap-envelope”

xmlns:SOAP-ENC=“http://www.w3.org/2003/05/soap-encoding”

xmlns:xsi=“http://www.w3.org/2001/XMLSchema-instance”

xmlns:xsd=“http://www.w3.org/2001/XMLSchema”

xmlns:ns5=“http://schemas.microsoft.com/2003/10/Serialization/Arrays”

xmlns:ns7=“http://schemas.datacontract.org/2004/07/System.Collections”

xmlns:ns4=“http://schemas.microsoft.com/2003/10/Serialization/”

xmlns:ns6=“http://schemas.datacontract.org/2004/07/VideoOS.Common.Proxy.Server”

xmlns:ns1=“http://tempuri.org/”

xmlns:ns3=“http://videoos.net/2/XProtectCSServerCommand”

xmlns:c14n=“http://www.w3.org/2001/10/xml-exc-c14n#”

xmlns:wsu=“http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd”

xmlns:xenc=“http://www.w3.org/2001/04/xmlenc#”

xmlns:wsc=“http://schemas.xmlsoap.org/ws/2005/02/sc”

xmlns:ds=“http://www.w3.org/2000/09/xmldsig#”

xmlns:wsse=“http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd”

xmlns:ns8=“urn:videoos:management:server:servercommandservice”>

SOAP-ENV:Header

</SOAP-ENV:Header>

SOAP-ENV:Body

ns3:Login

ns3:instanceIdd3677c4c-dadc-44f9-b5af-ce670a8e5db8</ns3:instanceId>

ns3:currentToken</ns3:currentToken>

</ns3:Login>

</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

with the response being:

<s:Envelope xmlns:s=“http://www.w3.org/2003/05/soap-envelope” xmlns:a=“http://www.w3.org/2005/08/addressing”>

<s:Header>

    <a:Action s:mustUnderstand="1">[http://www.w3.org/2005/08/addressing/soap/fault</a:Action>](http://www.w3.org/2005/08/addressing/soap/fault%3C/a:Action%3E)

</s:Header>

<s:Body>

    <s:Fault>

        <s:Code>

            <s:Value>s:Sender</s:Value>

            <s:Subcode>

                <s:Value xmlns:a="[http://schemas.xmlsoap.org/ws/2005/02/sc](http://schemas.xmlsoap.org/ws/2005/02/sc)">a:BadContextToken</s:Value>

            </s:Subcode>

        </s:Code>

        <s:Reason>

            <s:Text xml:lang="en-US">The security context token is expired or is not valid. The message was not processed.</s:Text>

        </s:Reason>

    </s:Fault>

</s:Body>

</s:Envelope>

I used Postman on Ubuntu 16.04 LTS to send the request.

any clue?

2

I’m on mobile so forgive the low effort response here, but my first guess would be time synchronization. The WCF binding may be sensitive to significant differences in time between client and server even though you’re not explicitly doing a SSL/TLS connection over HTTPS. It’s probably not that easy but worth double checking!​

3

I don’t think this is the case because the machine is being used as client and the server at the same time. I even tried to send the same request on the machine itself but I’m getting the same error.

4

As far as I understood, Coming from Ubuntu will require you to login with a valid basic user which in turn requires SSL/TLS and the Active Directory (AD) authentication method will not work.

5

That is true for the current supported WCF channels but the deprecated ServerAPI channel still works and I’ve used it to get tokens and configuration from .NET Core using a Windows credential.

​ServerAPI/ServerCommandService.asmx

​

Like I said though, it’s deprecated so if you have problems with it or it is finally removed all together from the product, you’d be on your own.

​

I​ believe we are planning to address this in a future version of the SDK. Meanwhile, another avenue is to build your own Web API service to run on the management server, and use it to provide the features you need (tokens, configuration access). Fortunately the Event Server and Recording Server APIs are more x-plat friendly. So once you have a token and know what objects you want to work with, you can use the existing interfaces without much additional effort.

6

Noted! Any Sample/Document on integrating a Web API Service and register it on the Management Client?

7

I have tried a login with a valid basic user with SSL/TLS using SOAP, Can you check the issue here?

Thanks in advance.