We are running in to a strange situation in IIS where the require and accept client certificates settings are not behaving as we expect.
If configured to require a client certificate, and a valid certificate is presented, the app works as expected. However, if set to accept client certificates, the same cert causes our code to execute the following SecurityException because the AuthorizationContext.ClaimSets is 0
if (OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets.Count <= 0)
throw new SecurityException("No Certificate claimset - service configured wrong");
My understanding is that accept will still allow a request without a cert, but that if a cert is presented, it should behave the same as if it were required. What other difference is there between Accept and Require that is altering the AuthorizationContext?