WCF 4 - TransportWithMessageCredential使用X.509證書運輸和信息安全

Question

我試圖讓託管在IIS將使用X.509證書，郵件安全和與需要相互驗證SSL運輸安全WCF4服務（項目規範要求使用WS-Security 和 SSL，AFAIK只有一個通常是要走的路，但沒關係）。

我做了我TestRootCA並用它來頒發服務器證書（本地主機）和客戶端證書（TestUser用戶）。我首先只想建立和測試傳輸安全性，所以我配置IIS使用https，配置的SSL證書（我製作的localhost證書），並將IIS配置爲，要求客戶端提供客戶端證書。然後我修改了服務web.config，創建了相應的svcutil.conf，並運行了svcutil，成功爲我的測試WinForms應用程序創建了客戶端代理類和app.config。

var client = new ServiceClient(); 
client.ClientCredentials.ClientCertificate.SetCertificate(System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser, System.Security.Cryptography.X509Certificates.StoreName.My, System.Security.Cryptography.X509Certificates.X509FindType.FindBySubjectDistinguishedName, "CN=TestUser"); 
MessageBox.Show(client.GetData(42)); 

到目前爲止好：我通過調用創建代理客戶端時設置的證書。但是，當我修改服務的web.config以使用TrasportWithMessageCredential（而不是傳輸）並指定「Certificate」作爲clientCredentialType以獲得郵件安全性時，我獲得HTTP 403 - The HTTP request was forbidden with client authentication scheme 'Anonymous'，即使我指定了「Certificate」。

我最後的web.config文件看起來是這樣的：

<system.serviceModel> 
    <bindings> 
     <wsHttpBinding> 
      <binding name="wsHttpEndpointBinding"> 
       <security mode="TransportWithMessageCredential"> 
        <transport clientCredentialType="Certificate"/> 
        <message clientCredentialType="Certificate"/> 
       </security> 
      </binding> 
     </wsHttpBinding> 
    </bindings> 
    <services> 
     <service behaviorConfiguration="serviceBehavior" name="Service"> 
      <endpoint binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding" name="wsHttpEndpoint" contract="IService" /> 
      <endpoint address="mex" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding" name="mexEndpoint" contract="IMetadataExchange" /> 
     </service> 
    </services> 
    <behaviors> 
     <serviceBehaviors> 
      <behavior name="serviceBehavior"> 
       <serviceMetadata httpsGetEnabled="true" /> 
       <serviceDebug includeExceptionDetailInFaults="true" /> 
      </behavior> 
     </serviceBehaviors> 
    </behaviors> 
</system.serviceModel> 

和我的客戶app.conf：

<system.serviceModel> 
    <bindings> 
     <wsHttpBinding> 
      <binding name="wsHttpEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"> 
       <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" /> 
       <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" /> 
       <security mode="TransportWithMessageCredential"> 
        <transport clientCredentialType="Certificate"/> 
        <message clientCredentialType="Certificate"/> 
       </security> 
      </binding> 
     </wsHttpBinding> 
    </bindings> 
    <client> 
     <endpoint address="https://localhost/WCFTestService/Service.svc" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpoint" contract="IService" name="wsHttpEndpoint" /> 
    </client> 
</system.serviceModel> 

任何想法？

編輯：

我已經成功地得到它通過更改IIS設置SSL客戶端證書的工作從需要到接受。看來，當我介紹了使用SSL使用過的運輸安全證書信息安全，客戶端使用通過SSL相互認證的證書，郵件簽名，但不（它試圖身份登錄，即使它有指定的證書匿名 ）。

不知道爲什麼發生這種情況，我想從專家:)一些評論。

Answer 1

如問題所說，我把它改變IIS設置SSL客戶端證書從require到accept工作。然後在服務入口點，我編程檢查遠程用戶的證書（如果它不爲空並且有效）。

Answer 2

必須指定證書使用該消息中的行爲部分加密，因爲這些可能是不同的，因爲在那些用於建立HTTPS通道

它看起來像這樣在服務器

<system.serviceModel> 
<behaviors>  
    <serviceBehaviors>  
     <behavior name="serviceBehavior"> 
     <serviceCredentials> 
     <serviceCertificate findValue="ServerCertificate" 
          storeLocation="CurrentUser" 
          storeName="My" 
          x509FindType="FindByIssuerName" /> 
     <clientCertificate> 
      <certificate findValue ="ClientCertificate" 
         storeLocation="CurrentUser" 
          storeName="My" 
          x509FindType="FindByIssuerName"/> 
      <authentication certificateValidationMode ="PeerTrust"/> 
     </clientCertificate> 
     </serviceCredentials> 
      <serviceMetadata httpsGetEnabled="true" />  
      <serviceDebug includeExceptionDetailInFaults="true" />  
     </behavior>  
    </serviceBehaviors>  
</behaviors> 
</system.serviceModel> 

，做在客戶端一樣的，那應該是這樣的

<system.serviceModel>   
    <bindings>   
     <wsHttpBinding>   
      <binding name="wsHttpEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">   
       <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />   
       <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />   
       <security mode="TransportWithMessageCredential">   
        <transport clientCredentialType="Certificate"/>   
        <message clientCredentialType="Certificate"/>   
       </security>   
      </binding>   
     </wsHttpBinding>   
    </bindings> 
<behaviors>  
    <endpointBehaviors>   
    <behavior name="ClientCredentialsBehavior"> 
     <clientCredentials>    
     <clientCertificate x509FindType="FindBySubjectName" 
          findValue="ClientCertificate" 
          storeLocation="CurrentUser" 
          storeName="My"/> 
     <serviceCertificate> 
      <defaultCertificate x509FindType="FindBySubjectName" 
           findValue="ServerCertificate" 
           storeLocation="CurrentUser" 
           storeName="My"/> 
     </serviceCertificate> 
     </clientCredentials> 
    </behavior> 
    </endpointBehaviors> 
</behaviors> 

    <client>   
     <endpoint address="https://localhost/WCFTestService/Service.svc" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpoint" contract="IService" name="wsHttpEndpoint" behaviorConfiguration="ClientCredentialsBehavior" />   
    </client>   
</system.serviceModel> 

關當然，你必須設置證書的正確位置和名稱證書，在服務器和客戶端。

我希望這可以幫助仍然