代码之家  ›  专栏  ›  技术社区  ›  Saghar

在IIS中使用wsHttpBinding托管WCF服务时出现问题

  •  2
  • Saghar  · 技术社区  · 14 年前

    我正在尝试使用以下配置托管我的服务。

    <system.serviceModel>
        <services>
            <service name="Test.MyService" behaviorConfiguration="MyServiceBehavior">
                <!--         Service Endpoints -->
                <endpoint address="MyTestService" binding="wsHttpBinding" bindingConfiguration="WebserviceHttpBinding" contract="Test.IMyService"/>
                <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
            </service>
        </services>
        <bindings>
            <wsHttpBinding>
                <binding name="WebserviceHttpBinding">
                    <security mode="Message">
                        <message clientCredentialType="UserName" negotiateServiceCredential="false"/>
                    </security>
                </binding>
            </wsHttpBinding>
        </bindings>
        <behaviors>
            <serviceBehaviors>
                <behavior name="MyServiceBehavior">
                    <serviceCredentials>
                        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Test.CredentialValidator, Test"/>
                        <serviceCertificate findValue="RPKey" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
                    </serviceCredentials>
                    <!--           To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
                    <serviceMetadata httpGetEnabled="true"/>
                    <!--           To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
                    <serviceDebug includeExceptionDetailInFaults="true"/>
                </behavior>
            </serviceBehaviors>
        </behaviors>
    </system.serviceModel>
    

    当我调试这个服务时,我没有问题。我用这个网站在IIS中托管了这个服务。当我从IIS浏览这个服务时,我得到以下异常。

    应用程序。

    密钥集不存在

    在执行过程中发生 当前web请求。请检查 错误及其来源

    异常详细信息: System.Security.Cryptography.CryptographyException异常:

    源错误:

    生成了未处理的异常 在电流执行过程中 web请求。关于 可以使用异常来识别

    堆栈跟踪:

    [CryptographicException:密钥集不存在 ] System.Security.Cryptography.Utils.CreateProvHandle(CspParameters,Boolean randomKeyContainer)+369 System.Security.Cryptography.rsacyptoserviceprovider.GetKeyPair()+85 System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize,CspParameters,Boolean useDefaultKeySize)+280 System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey()+468

    [ArgumentException:证书'CN=RPKey'必须具有能够进行密钥交换的私钥。进程必须具有私钥的访问权限。] System.ServiceModel.Security.SecurityUtils.EnsureCertificateCanDoKeyExchange(X509Certificate2证书)+15832031 System.ServiceModel.Security.ServiceCredentialsSecurityTokenManager.CreateServerX509TokenProvider()+45 System.ServiceModel.Security.ServiceCredentialsSecurityTokenManager.CreateLocalSecurityTokenProvider(RecipientServiceModelSecurityTokenRequirement recipientRequirement)+73 System.ServiceModel.Security.ServiceCredentialsSecurityTokenManager.CreateSecurityTokenProvider(SecurityTokenRequirement要求)+65 System.ServiceModel.Security.SymmetricSecurityProtocolFactory.OnOpen(TimeSpan超时)+15334232 System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan超时)+23 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan超时)+563 System.ServiceModel.Security.SecurityListenerSettingsLifetimeManager.Open(TimeSpan超时)+101 1.OnOpen(TimeSpan timeout) +203 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +563 System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout) +87 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +563 System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) +110 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +563 System.ServiceModel.Security.SecuritySessionSecurityTokenAuthenticator.OnOpen(TimeSpan timeout) +149 System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout) +23 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +563 System.ServiceModel.Security.SecurityUtils.OpenCommunicationObject(ICommunicationObject obj, TimeSpan timeout) +24 System.ServiceModel.Security.SecuritySessionServerSettings.OnOpen(TimeSpan timeout) +878 System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout) +23 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) +563 System.ServiceModel.Security.SecurityListenerSettingsLifetimeManager.Open(TimeSpan timeout) +153 System.ServiceModel.Channels.SecurityChannelListener System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan超时)+563 System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan超时)+563 System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan超时)+110 System.ServiceModel.HostingManager.ActivateService(字符串normalizedVirtualPath)+135 System.ServiceModel.HostingManager.ensurereserviceavailable(字符串normalizedVirtualPath)+654

    [ServiceActivationException:由于编译期间出现异常,无法激活服务'/AtlasServices/service.svc'。异常消息是:证书“CN=RPKey”必须具有能够进行密钥交换的私钥。进程必须具有私钥的访问权限..] System.ServiceModel.Activation.hostedHTTPPrequestAsyncResult.End(IAsyncResult结果)+15623609 System.ServiceModel.Activation.HostedHTTPPrequestAsyncResult.ExecuteSynchronous(HttpApplication上下文,布尔流上下文)+265 System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()+80 System.Web.HttpApplication.ExecuteStep(IExecutionStep步骤,布尔值&同步完成)+171

    4 回复  |  直到 14 年前
        1
  •  4
  •   Nealv    14 年前

    这是因为在IIS上,帐户设置与您用来运行本地服务器的帐户不同。

    如果是,您确定为运行包含私钥的文件的进程(运行IIS)的帐户授予了读取权限吗?

    @更新

    ArgumentException:证书“CN=RPKey”必须具有能够进行密钥交换的私钥。进程必须具有私钥的访问权限。

        2
  •  1
  •   jrista    14 年前

    根据例外报告,这听起来像两件事之一可能正在发生。您正在引用的证书已安装到密钥库中,但仅使用公钥,或者已安装的证书受到限制,并且您的应用程序池运行所用的帐户没有访问该密钥的权限。

    如果x.509证书不是作为.pfx导出的,而是作为.cer导出的,那么前一种情况非常容易遇到。若要交换包含私钥的证书,.cer格式不足,因为它只能包含DER编码的x.509公钥证书。必须将证书从证书服务器(或同时具有两个密钥的存储)导出为.pfx文件,并确保包含私钥。

    Make X.509 Certificates Accessible to WCF

        3
  •  1
  •   Yuri    14 年前

    IIS应用程序池标识无权访问证书

    1. 将应用程序池标识设置为网络服务
    2. 安装 rktools
    3. 运行“c:\Program Files(x86)\Windows Resource Kits\Tools\winhttpcertcfg.exe”-g-c LOCAL\u MACHINE\My-s WSE2QuickStartServer-a“网络服务”
        4
  •  0
  •   Lucas B    14 年前

    如果您不需要wshttpbinding,只要尝试更改为basichttpbinding,您的问题可能就会消失。