WCF自定义证书验证不验证

Question

I'm trying to find an error in my wcf configuration, but I can't find where is problem. Propably I need couple more eyes; anyway I want to use custom certification validation in wcf. I seted break point in my CertificateValidator class but this break point didn't catch any request, but application is running and I can send requests (without certificate).

Here is my configuration

<system.serviceModel>
  <bindings>
    <basicHttpBinding>
      <binding maxReceivedMessageSize="104857600">
        <security>
          <message clientCredentialType="Certificate" />
        </security>
      </binding>
    </basicHttpBinding>
  </bindings>

  <services>
    <service name="AccountService" behaviorConfiguration="">
      <endpoint address="" binding="basicHttpBinding" bindingConfiguration="" contract="IAccountService"></endpoint> 
    </service>
    <service name="PortalService" behaviorConfiguration="">
      <endpoint address="" binding="basicHttpBinding" bindingConfiguration="" contract="IPortalService"></endpoint>
    </service>
  </services>

  <behaviors>
    <serviceBehaviors>
      <behavior>
        <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
        <serviceDebug includeExceptionDetailInFaults="false"/>
        <serviceCredentials>
          <clientCertificate>
            <authentication certificateValidationMode="Custom" customCertificateValidatorType="Services.Validators.CertificateValidator, Services" />
          </clientCertificate>
        </serviceCredentials>
      </behavior>
    </serviceBehaviors>
  </behaviors>
  <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
  </protocolMapping>    
  <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>

Answer 1

Are you using NET 4, or 4.5?

Things I think you missed:

• your custom basicHttpBinding needs to use <security mode="Message"> (currently you aren't specifying it, which means default of "None" )
• your custom basicHttpBinding needs a name= so it can be referenced
• your endpoints need to reference the custom basicHttpBinding by using bindingConfiguration=
• your custom service behavior needs a name= so it can be referenced
• your service needs to reference the custom service behaviour by using behaviorConfiguration=
• your service needs to specify a <serviceCertificate> in <serviceCredentials> which is used in the protocol to establish a secure channel with clients
• your client needs to know the '<serviceCertificate>' in <clientCredentials> so that it can establish a secure channel with the server
• your client needs to attach the certificate being used for credential to the request(s) being sent to the server (either by specifying in it <clientCertificate> in <clientCredentials> in the .config, or programmatically)
• make sure you have your certificates created and installed properly

Note: you should have created at least 2 certificates - 1 used for the identity of the Server - 1 or more used by clients for credentials (depends if you decide all clients should present the same certificate, or if you assign unique ones for each one) - DO NOT use the same certificate for Server identify and Client credentials

Some links to help understand "message level security":

• http://dotnetmentors.com/wcf/wcf-message-level-security-by-example.aspx
• http://shaunrostami.blogspot.co.uk/2012/02/there-are-situation-where-you-cant-use.html
• https://msdn.microsoft.com/en-us/library/ms733098%28v=vs.110%29.aspx

Consider using "Transport" level security if your message exchange is too slow for you.

Try this:

  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="securebasicHttpBinding" maxReceivedMessageSize="104857600">
          <security mode="Message">
            <message clientCredentialType="Certificate" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>

    <services>
      <service behaviorConfiguration="secureBehaviour" name="AccountService">
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="securebasicHttpBinding"
          contract="IAccountService" />
      </service>
      <service behaviorConfiguration="secureBehaviour" name="PortalService">
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="securebasicHttpBinding"
          contract="IPortalService" />
      </service>
    </services>

    <behaviors>
      <serviceBehaviors>
        <behavior name="secureBehaviour">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="false"/>
          <serviceCredentials>
            <serviceCertificate ...something goes here... />
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="Services.Validators.CertificateValidator, Services" />
            </clientCertificate>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
  </system.serviceModel>