代码之家 › 专栏 › 技术社区 › galets

具有证书身份验证的basichttpbinding-错误“禁止”?

web-services wcf

galets · 技术社区 · 15 年前

我正在尝试使用basichttpbinding在传输级别上使用ssl证书让wcf服务器和客户机相互验证。以下是创建服务器的方法:

var soapBinding = new BasicHttpBinding() { Namespace = "http://test.com" };
soapBinding.Security.Mode = BasicHttpSecurityMode.Transport;
soapBinding.Security.Transport.ClientCredentialType =
    HttpClientCredentialType.Certificate;
var sh = new ServiceHost(typeof(Service1), uri);
sh.AddServiceEndpoint(typeof(IService1), soapBinding, "");
sh.Credentials.ServiceCertificate.SetCertificate(
    StoreLocation.LocalMachine, StoreName.My, 
    X509FindType.FindBySubjectName, "localhost");
sh.Open();

这是客户:

var binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.Transport;
var service = new ServiceReference2.Service1Client(binding,
    new EndpointAddress("https://localhost:801/Service1"));

service.ClientCredentials.ClientCertificate.SetCertificate(
    StoreLocation.LocalMachine, StoreName.My, 
    X509FindType.FindBySubjectName, "localhost");

service.ClientCredentials.ServiceCertificate.Authentication.
    CertificateValidationMode =
        System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust;

service.HelloWorld();

本地主机的证书位于个人、受信任的根和受信任的第三方容器中。Internet Explorer可以连接到主机并查看WSDL。此外,对于clientCredentialType=httpClientCredentialType.none,SSL调用也可以正常工作。

helloworld()失败:

System.ServiceModel.Security.MessageSecurityException occurred<br/>
  Message="The HTTP request was forbidden with client authentication
  scheme 'Anonymous'."

这是来自以下位置的rethrown异常:“远程服务器返回错误:(403)禁止。”

你怎么知道世界跆拳道是怎么回事?

2 回复 | 直到 15 年前

John Smith 15 年前

在设置之后尝试将此添加到客户端 Security.Mode :

binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;

opewix 9 年前

答案已经完成,但对于其他人:

如果使用的是app.config中配置的Standart生成的代理,则必须设置 transport clientCredentialType到 Certificate

(请确保XML元素不是 <message clientCredentialType ... /> )

            <binding name="SpoDataServiceSoap">
                <security mode="Transport">
                    <transport clientCredentialType="Certificate"></transport>
                </security>
            </binding>

C.*

MyServiceSoapClient client = new MyServiceSoapClient()
X509Certificate2 cert = CertificateHelper.GetClientCertificate();
client.ClientCredentials.ClientCertificate.Certificate = cert;