WCF - 消息凭据与TransportWithMessageCredential证书验证

Question

我在设置WCF服务消息凭据安全性时遇到了一个有趣的问题。我在客户端遇到这个例外：

An unhandled exception of type 'System.InvalidOperationException' occurred in mscorlib.dll

Additional information: The service certificate is not provided for target 'http://myMachine/SPTestService/Service1.svc'. Specify a service certificate in ClientCredentials. 

这让我相信我需要在客户端配置中指定服务器证书，但我不确定原因。这应该是使用ChainTrust。有趣的是，当我将其切换到TransportWithMessageCredential（因此它通过SSL工作）时，它可以工作，并正确验证消息凭证。这是WCF的错误吗？幸运的是，TransportWithMessageCredential是我前进的地方，因此我将加快这一进程。

仅使用Message凭证，我的配置如下所示：

客户端：

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.serviceModel>
        <behaviors>
            <endpointBehaviors>
                <behavior name="serviceBehavior">
                    <clientCredentials>
                        <clientCertificate storeName="My" storeLocation="LocalMachine"
                                           findValue="CN=myCert" />
                    </clientCredentials>
                </behavior>
            </endpointBehaviors>
        </behaviors>
        <bindings>
            <basicHttpBinding>
                <binding name="serviceEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00"
                    receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                    bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Mtom" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="Message">
                        <transport clientCredentialType="None" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="Certificate" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="http://myMachine/SPTestService/Service1.svc"
                behaviorConfiguration="serviceBehavior"      
                binding="basicHttpBinding" bindingConfiguration="serviceEndpoint"
                contract="ServiceReference2.IService1" name="serviceEndpoint" />
        </client>
    </system.serviceModel>
</configuration>

服务：

<?xml version="1.0"?>
<configuration>

  <system.web>
    <compilation debug="true" targetFramework="4.0" />
  </system.web>  
  <system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="serverBinding" messageEncoding="Mtom">
                <security mode="Message">
                    <message clientCredentialType="Certificate" />
                </security>
            </binding>
        </basicHttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="serviceBehavior">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <dataContractSerializer maxItemsInObjectGraph="2147483646" />
          <serviceCredentials>
            <serviceCertificate storeName="My" storeLocation="LocalMachine" findValue="CN=myCert"  />
            <clientCertificate>
                <authentication revocationMode="NoCheck"/>
            </clientCertificate>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
      <services>
          <service behaviorConfiguration="serviceBehavior" name="SPTestService.Service1">
              <endpoint address="" binding="basicHttpBinding" bindingConfiguration="serverBinding" name="serviceEndpoint" contract="SPTestService.IService1" />
          </service>
      </services>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>

</configuration>

使用TransportWithMessage，我的配置看起来像这样：

客户端：

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.serviceModel>
        <behaviors>
            <endpointBehaviors>
                <behavior name="serviceBehavior">
                    <clientCredentials>
                        <clientCertificate storeName="My" storeLocation="LocalMachine"
                                           findValue="CN=myCert" />
                    </clientCredentials>
                </behavior>
            </endpointBehaviors>
        </behaviors>
        <bindings>
            <basicHttpBinding>
                <binding name="serviceEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00"
                    receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                    bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Mtom" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="TransportWithMessageCredential">
                        <transport clientCredentialType="None" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="Certificate" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="https://myMachine/SPTestService/Service1.svc"
                behaviorConfiguration="serviceBehavior"      
                binding="basicHttpBinding" bindingConfiguration="serviceEndpoint"
                contract="ServiceReference2.IService1" name="serviceEndpoint" />
        </client>
    </system.serviceModel>
</configuration>

服务：

<?xml version="1.0"?>
<configuration>

  <system.web>
    <compilation debug="true" targetFramework="4.0" />
  </system.web>  
  <system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="serverBinding" messageEncoding="Mtom">
                <security mode="TransportWithMessageCredential">
                    <message clientCredentialType="Certificate" />
                </security>
            </binding>
        </basicHttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="serviceBehavior">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <dataContractSerializer maxItemsInObjectGraph="2147483646" />
          <serviceCredentials>
            <serviceCertificate storeName="My" storeLocation="LocalMachine" findValue="CN=myCert"  />
            <clientCertificate>
                <authentication revocationMode="NoCheck"/>
            </clientCertificate>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
      <services>
          <service behaviorConfiguration="serviceBehavior" name="SPTestService.Service1">
              <endpoint address="" binding="basicHttpBinding" bindingConfiguration="serverBinding" name="serviceEndpoint" contract="SPTestService.IService1" />
          </service>
      </services>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>

</configuration>