Question

我正在努力完成一项简单的任务：使用Message security选项创建安全的WCF服务。 WCF服务应仅响应提供有效X509证书的客户端。对客户端进行身份验证后，应将其视为匿名用户，但会执行其请求。使用Http，而不是HTTPS。的wsHttpBinding。

我使用自定义的root权限证书创建了一个自签名证书。我已经将它们都上传到了Web服务器。我已正确安装。我已将自签名证书的只读访问权限授予“Everyone”私钥（至少目前是为了消除密钥权限问题）。

我已在客户端计算机上安装了自签名证书。我正在使用客户端证书向我的WCF服务提供调用。我收到以下错误： {“无法满足安全令牌请求，因为身份验证失败。”} Web服务器在事件查看器中报告“登录失败”安全事件：

Subject:
    Security ID:        SYSTEM
    Account Name:       WEB-XXXXX
    Account Domain:     XXXXXX
    Logon ID:       0x3e7

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       
    Account Domain:     

Failure Information:
    Failure Reason:     Unknown user name or bad password.
    Status:         0xc000006d
    Sub Status:     0xc0000064

以下是WCF服务的相关web.config：

  <system.serviceModel>

    <bindings>
      <wsHttpBinding>
        <clear/>
        <binding name="wsHttpBindingSecure">
          <security mode="Message">
            <message clientCredentialType="Certificate"/>
            <transport clientCredentialType="None"></transport>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

    <services>
      <service behaviorConfiguration="LegacyServiceBehavior" name="RDC.External.MainSite.LegacyDataProvider.WCF.LegacyService">
        <endpoint address="secure" bindingConfiguration="wsHttpBindingSecure" binding="wsHttpBinding" name="Secure" contract="RDC.Domain.Commerce.Common.ILegacySecureService">
          <identity>
            <certificateReference findValue="legacyservice" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
          </identity>
        </endpoint>
      </service>
    </services>

    <behaviors>
      <serviceBehaviors>
        <behavior name="LegacyServiceBehavior">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials>
            <serviceCertificate findValue="legacyservice" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>

以下是客户端app.config的相关部分：

  <system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="Secure" closeTimeout="00:01:00" openTimeout="00:01:00"
            receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false"
            transactionFlow="false" hostNameComparisonMode="StrongWildcard"
            maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
            messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
            allowCookies="false">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
              maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00"
              enabled="false" />
          <security mode="Message">
            <message clientCredentialType="Certificate" negotiateServiceCredential="true"
                algorithmSuite="Default"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <client>
      <endpoint address="http://www---url---.com/secure"
          binding="wsHttpBinding" behaviorConfiguration="secureBehavior" bindingConfiguration="Secure" contract="RDC.Domain.Commerce.Common.ILegacySecureService"
          name="Secure">
        <identity>
          <certificateReference x509FindType="FindBySubjectName" findValue="legacyservice" storeLocation="LocalMachine" storeName="My"/>
        </identity>
      </endpoint>
    </client>
    <behaviors>
      <endpointBehaviors>
        <behavior name="secureBehavior">
          <clientCredentials supportInteractive="false">
            <clientCertificate x509FindType="FindBySubjectName" findValue="legacyservice" storeLocation="LocalMachine" storeName="My"/>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>
  </system.serviceModel>

过去3天我一直在努力解决这个问题，并且是我最后的努力......对于我做错了什么建议？

谢天谢地

使用Message安全模式的WCF服务的简单证书安全性

0 个答案: