How to perform ssl user authentication

user_14545515 0
Viewed 82

A self-signed certificate is used for authentication in the WCF application. The server specified:

<security mode="Message">
    <message clientCredentialType="Certificate"/>
</security>
...
<clientCertificate>
  <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>
</clientCertificate>

The certificate is enabled correctly on the client:

<endpointBehaviors>
<behavior name="wsHttpCertificateBehavior">          
  <clientCredentials>
    <clientCertificate findValue="<Thumbprint>" storeName="My" storeLocation="LocalMachine" x509FindType="FindByThumbprint"/>    
  </clientCredentials>          
</behavior>
</endpointBehaviors>

On the client, the certificate is added to the trusted root certificates. When calling service methods, an error occurs: the calling user's identity was not verified by the service. I don't understand what else you need to specify for verification. If you remove the certificate and specify

<security mode= "None"/>

the client hangs when calling the service method. I don't understand why. I've been fighting this for a week. Please help me!

ssl wcf
1 Answers

This is a demo using X.509 self-signed certificate verification:

<system.serviceModel>
    <services>
      <service name="Microsoft.Samples.X509CertificateValidator.CalculatorService" behaviorConfiguration="CalculatorServiceBehavior">
        <!-- use host/baseAddresses to configure base address provided by host -->
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost:8001/servicemodelsamples/service"/>
          </baseAddresses>
        </host>
        <!-- use base address specified above, provide one endpoint -->
        <endpoint address="certificate" binding="wsHttpBinding" bindingConfiguration="Binding" contract="Microsoft.Samples.X509CertificateValidator.ICalculator"/>
      </service>
    </services>

    <bindings>
      <wsHttpBinding>
        <!-- X509 certificate binding -->
        <binding name="Binding">
          <security mode="Message">
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

    <behaviors>
      <serviceBehaviors>
        <behavior name="CalculatorServiceBehavior">
          <serviceDebug includeExceptionDetailInFaults="true"/>
          <serviceCredentials>
            <!-- 
            The serviceCredentials behavior allows one to specify authentication constraints on client certificates.
            -->
            <clientCertificate>
              <!-- 
              Setting the certificateValidationMode to Custom means that if the custom X509CertificateValidator
              does NOT throw an exception, then the provided certificate will be trusted without performing any
              validation beyond that performed by the custom validator. The security implications of this 
              setting should be carefully considered before using Custom in production code. 
              -->
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="Microsoft.Samples.X509CertificateValidator.CustomX509CertificateValidator, service"/>
            </clientCertificate>
            <!-- 
            The serviceCredentials behavior allows one to define a service certificate.
            A service certificate is used by a client to authenticate the service and provide message protection.
            This configuration references the "localhost" certificate installed during the setup instructions.
            -->
            <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    
  </system.serviceModel>

This is the configuration file of the service, we need to specify the location of the certificate.

serviceHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.Custom;
              
serviceHost.Credentials.ClientCertificate.Authentication.CustomCertificateValidator = new CustomX509CertificateValidator();

We custom verify the self-signed certificate.

public class CustomX509CertificateValidator : System.IdentityModel.Selectors.X509CertificateValidator
    {
        // This Validation function accepts any X.509 Certificate that is self-issued. As anyone can construct such
        // a certificate this custom validator is less secure than the default behavior provided by the
        // ChainTrust X509CertificateValidationMode. The security implications of this should be carefully 
        // considered before using this validation logic in production code. 
        public override void Validate(X509Certificate2 certificate)
        {
            // Check that we have been passed a certificate
            if (certificate == null)
                throw new ArgumentNullException("certificate");

            // Only accept self-issued certificates
            if (certificate.Subject != certificate.Issuer)
                throw new SecurityTokenException("Certificate is not self-issued");
        }
    }

If you need a complete example of this demo you can download it in this link:

https://www.microsoft.com/en-us/download/details.aspx?id=21459

user_117746180
Related