HTTP請求被禁止，客戶端身份驗證方案爲「匿名」。遠程服務器返回錯誤：（403）Forbidden

Question

我正在嘗試創建一個安全的web服務。

這裏是合同和服務實現

[ServiceContract()] 
public interface ICalculatorService 
{ 
    [OperationContract()] 
    int Add(int x, int y); 
} 

[ServiceBehavior(IncludeExceptionDetailInFaults=true)] 
public class CalculatorService : ICalculatorService 
{ 
    public int Add(int x, int y) 
    { 
     return x + y; 
    } 
} 

在這裏，我的服務代碼

var b = new WSHttpBinding(SecurityMode.Transport); 
b.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate; 
b.Security.Message.ClientCredentialType = MessageCredentialType.None; 

Type contractType = typeof(ICalculatorService); 
Type implementedContract = typeof(CalculatorService); 
Uri baseAddress = new Uri("https://localhost:8006/CalculatorService"); 
ServiceHost sh = new ServiceHost(implementedContract); 

sh.AddServiceEndpoint(contractType, b, baseAddress); 

//ServiceMetadataBehavior sm = new ServiceMetadataBehavior(); 
//sm.HttpsGetEnabled = true; 
//sm.HttpsGetUrl = new Uri("https://localhost:8006/CalculatorServiceMex"); 
//sh.Description.Behaviors.Add(sm); 

sh.Credentials.Peer.PeerAuthentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust; 
     sh.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.TrustedPeople, X509FindType.FindBySubjectName, "localhost"); 

sh.Open(); 
Console.WriteLine("Service is Listening"); 
Console.ReadLine(); 
sh.Close(); 

下面是客戶端代碼

var b = new WSHttpBinding(SecurityMode.Transport); 
b.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate; 
b.Security.Message.ClientCredentialType = MessageCredentialType.None; 

var factory = new ChannelFactory<ICalculatorService>(b); 
factory.Credentials.Peer.PeerAuthentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust; 
     factory.Credentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.TrustedPeople, X509FindType.FindBySubjectName, "localhost"); 

var client = factory.CreateChannel(new EndpointAddress(new Uri("https://localhost:8006/CalculatorService"))); 

ServicePointManager.ServerCertificateValidationCallback = 
    ((sender, certificate, chain, sslPolicyErrors) => 
      { 
       return true; 
      }); 

ICommunicationObject comObject = client as ICommunicationObject; 
int result = -1; 
try 
{ 
    comObject.Open(); 
    result = client.Add(10, 2); 
} 
catch (Exception ex) 
{ 

} 
Console.WriteLine(string.Format("Service say 10 + 2 = {0}", -1)); 
Console.ReadLine(); 

服務運行正常，並且當ServicePointManager.ServerCertificateValidationCallback檢查沒有策略錯誤，建立正確的證書鏈。

我有我的受信任的根，並在TrustedPeople存儲的服務器/客戶端證書CA。另外，如果我從瀏覽器導航到網站，我會看到返回的頁面。沒有錯誤

我已經更新IIS來什麼，我認爲是必要的，在IIS

，並通過以下命令行綁定的證書。

我已經設置了SSL設置爲接受證書

並啓用匿名身份驗證。

有誰知道我沒有正確地做過什麼步驟或看到任何不妥之處？我一直收到相同的錯誤「HTTP請求被客戶端認證方案'Anonymous'禁止。」

Answer 1

當您在IIS安全型運輸和客戶端憑據類型證書託管WCF服務，把你的客戶端證書的根存儲和IIS啓用匿名身份驗證。 Enable anonymous authentication in IIS. But most importantly, add your certificate to root store.

Answer 2

如果您運行的自託管WCF服務（沒有IIS），您可以通過向confing文件（服務器）使anonymnous客戶folowings：

<behaviors> 
    <serviceBehaviors> 
     <behavior name="limitedAuthBehavior"> 
      <serviceAuthenticationManager authenticationSchemes="Anonymous, Basic, Digest, Negotiate"/> 
      <!-- ... --> 
     </behavior> 
    </serviceBehaviors> 
</behaviors> 

此外，設置clientCredentialType爲 「InheritedFromHost」：

<bindings> 
     <basicHttpBinding> 
     <binding name="secureBinding"> 
      <security mode="Transport"> 
      <transport clientCredentialType="InheritedFromHost" /> 
      </security> 
     </binding> 
     </basicHttpBinding> 
</bindings> 

---

參考文獻：

Using Multiple Authentication Schemes with WCF

Understanding HTTP Authentication

Answer 3

我們有此錯誤信息，併爲我們的解決方案是處理程序映射功能的權限沒有被腳本啓用。您可以在IIS下處理程序映射啓用此>編輯功能權限，或者在你的web.config添加Script到handlers節點的accessPolicy屬性：

<system.webServer> 
    <handlers accessPolicy="Script"> 
    ... 
    </handlers> 
</system.webServer> 

Answer 4

另一個原因是在服務器上的證書本身你在打。確保你已經導入了PRIVATE KEY。在MMC中，這將顯示一個「友好名稱」。這花了我幾天的時間來弄清楚。一旦我導入了私鑰，匿名錯誤消失了，一切都很好！