basicHttpBinding身份验证错误

Question

I am new on web services and I need to implement basicHttpBinding to an existing web service with wsHttpsBinding and basicHttpBinding for a C# desktop application. When I try to consume the service with the desktop application I get the following error:

The HTTP request was forbidden with client authentication scheme 'Anonymous'.

The web.config file on the web service with the basicHttpBinding and the wsHttpsBinding looks like this:

<system.serviceModel>
<diagnostics>
  <messageLogging logEntireMessage="true" logMalformedMessages="true"
    logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true"
    maxMessagesToLog="25000">
    <filters>
      <clear />
    </filters>
  </messageLogging>
</diagnostics>

<behaviors>
  <serviceBehaviors>
    <behavior name="SecureBehave">
      <serviceCredentials>
        <clientCertificate>
          <authentication certificateValidationMode="PeerTrust"/>
        </clientCertificate>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="HIBridgeLib.HIBridgeService.Security.MessageSecurityValidator, HIBridgeLib"/>
        <!--
        <serviceCertificate findValue="WCfServer"
          storeLocation="CurrentUser"
          storeName="My"
          x509FindType="FindBySubjectName" />
        -->
      </serviceCredentials>
      <serviceMetadata httpGetEnabled="True" httpsGetEnabled="True"/>
      <serviceDebug includeExceptionDetailInFaults="True" />
    </behavior>
  </serviceBehaviors>
</behaviors>

<bindings>
  <wsHttpBinding>
    <binding name="HIBridge_SSLBinding" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647">
      <security mode="TransportWithMessageCredential">
        <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" />
        <message clientCredentialType="UserName" negotiateServiceCredential="True" establishSecurityContext="True" />
      </security>
    </binding>
  </wsHttpBinding>

  <basicHttpBinding>
    <binding name="HIBridge_BasicBinding" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647">
      <security mode="Transport">
        <transport clientCredentialType="Certificate" proxyCredentialType="None" realm="" />
      </security>
      <readerQuotas maxStringContentLength="2147483647" />
    </binding>
  </basicHttpBinding>
</bindings>

<services>
  <service name="HIBridgeWebService.HIBridgeService" behaviorConfiguration="SecureBehave">
    <endpoint address="basic" binding="basicHttpBinding" bindingConfiguration="HIBridge_BasicBinding" contract="HIBridgeLib.HIBridgeService.IHIBridgeService"></endpoint>
    <endpoint address="ws" binding="wsHttpBinding" bindingConfiguration="HIBridge_SSLBinding" contract="HIBridgeLib.HIBridgeService.IHIBridgeService"></endpoint>
    <host>
      <baseAddresses>
        <add baseAddress="https://10.50.1.85:1125/HIBridge/HIBridgeService.svc" />
      </baseAddresses>
    </host>
  </service>
</services>

The userNameAuthentication looks like this:

namespace HIBridgeLib.HIBridgeService.Security
{
  public class MessageSecurityValidator : UserNamePasswordValidator
  {
     private const string USERNAME = "username";
     private const string PASSWORD = "password";

     public override void Validate(string userName, string password)
     {
        if (userName == null || password == null)
        {
            throw new ArgumentNullException();
        }

        if (USERNAME.Equals(userName) && PASSWORD.Equals(password))
        { 
        }
        else
        {    
            throw new FaultException("Invalid Message Security Credentials");
        }
    }
  }
}

And my desktop application code looks like this to consume the web service:

ChannelFactory<HIBridgeLib.HIBridgeService.IHIBridgeService> myChannelFactory = null;
HIBridgeLib.HIBridgeService.IHIBridgeService HIBridgeService = null;
System.ServiceModel.BasicHttpBinding basicHTTPBinding = new System.ServiceModel.BasicHttpBinding();

basicHTTPBinding.Name = "HIBridge_BasicBinding";
basicHTTPBinding.OpenTimeout = TimeSpan.FromMinutes(1);
basicHTTPBinding.CloseTimeout = TimeSpan.FromMinutes(1);
basicHTTPBinding.SendTimeout = TimeSpan.FromMinutes(1);
basicHTTPBinding.ReceiveTimeout = TimeSpan.FromMinutes(10);
basicHTTPBinding.BypassProxyOnLocal = false;                
basicHTTPBinding.HostNameComparisonMode = System.ServiceModel.HostNameComparisonMode.StrongWildcard;
basicHTTPBinding.MaxBufferPoolSize = 2147483647;
basicHTTPBinding.MaxReceivedMessageSize = 2147483647;
basicHTTPBinding.MessageEncoding = System.ServiceModel.WSMessageEncoding.Text;
basicHTTPBinding.TextEncoding = Encoding.UTF8;
basicHTTPBinding.UseDefaultWebProxy = true;
basicHTTPBinding.AllowCookies = false;
basicHTTPBinding.Security.Mode = System.ServiceModel.BasicHttpSecurityMode.TransportWithMessageCredential;
basicHTTPBinding.Security.Transport.ClientCredentialType = System.ServiceModel.HttpClientCredentialType.Certificate;
basicHTTPBinding.Security.Transport.ProxyCredentialType = System.ServiceModel.HttpProxyCredentialType.None;
basicHTTPBinding.Security.Transport.Realm = "";

System.ServiceModel.EndpointAddress endpointAddress = null;

if (LocalMedCart.CartProfile.ConsoleHostname.Contains("/HIBridge/HIBridgeService.svc"))
      endpointAddress = new System.ServiceModel.EndpointAddress(LocalMedCart.CartProfile.ConsoleHostname + "/basic");
else
      endpointAddress = new System.ServiceModel.EndpointAddress(string.Format("https://{0}:{1}/HIBridge/HIBridgeService.svc/basic", LocalMedCart.CartProfile.ConsoleHostname, LocalMedCart.CartProfile.CommunicationPort));

HIBridgeLib.HIBridgeService.Security.PermissiveCertificatePolicy.Enact(string.Format("CN={0}", LocalMedCart.CertificateName));

myChannelFactory = new ChannelFactory<HIBridgeLib.HIBridgeService.IHIBridgeService>(basicHTTPBinding, endpointAddress);
myChannelFactory.Credentials.UserName.UserName = "username";
HIBridgeService = myChannelFactory.CreateChannel();

//do something

((IClientChannel)HIBridgeService).Close();
myChannelFactory.Close();

What is causing the error?

Answer 1

It sounds like you are specifically targeting the basicHttpBinding of the service. So, the wsHttpBinding settings are irrelevant, as is the MessageSecurityValidator class. In general, your client-side settings should match the server-side settings, which use transport security with a client credential certificate . The user will be identified by this certificate as far as WCF is concerned. So, instead of trying to set a username, you need to ensure that you are using a valid, server-recognized certificate. Unfortunately, I do not have quite enough information to troubleshoot exactly what is wrong with your certificate, but check that:

1. Your local certificate store (on the machine running the desktop application) actually has a certificate that the service recognizes as valid.
2. The certificate is specified correctly. MSDN suggests something along the lines of myClient.ClientCredentials.ClientCertificate.SetCertificate(...) to provide the certificate. (The example service in the link uses wsHttpBinding rather than basicHttpBinding , but for this aspect of configuration, it should make no difference.)
3. The web server hosting the service is actually configured for client certificate authentication. One reference suggests checking the output of netsh http show sslcert at an administrator command prompt on the web server to see whether Negotiate Client Certificate is enabled for the site.