WCF 客户端证书验证 + Windows 身份验证

Question

I've successfully created a WCF service which validates the incoming client certificate against the chain configured in IIS. However, as this is only a security mechanism to support authentication, I also need the Windows user calling my WCF service to handle authorization.

Normally when extracting the Windows User, you would do it like this

ServiceSecurityContext.Current.WindowsIdentity.Name

When my service is configured with security mode TransportWithMessageCredentials , the PrimaryIdentity in the ServiceSecurityContext will return the certificate's SubjectName and the WindowsIdentity will be empty.

To look at the client configuration, I've specified the WsHttpBinding like this

private static Binding GetHttpsBinding()
{
    var binding = new WSHttpBinding();
    binding.Security.Mode = SecurityMode.TransportWithMessageCredential;
    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;
    binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;

    return binding;
}

The client certificate is added like to the proxy client like this:

private static void ApplyClientCertificate(HelloServiceClient client)
{
    client.ClientCredentials.ClientCertificate.SetCertificate(

        storeLocation: StoreLocation.CurrentUser,
        storeName: StoreName.My,
        findType: X509FindType.FindBySubjectName,
        findValue: "ClientCertificatesTest"

   );
}

Switching the two ClientCredentialType values so the binding looks like this

private static Binding GetHttpsBinding()
{
    var binding = new WSHttpBinding();
    binding.Security.Mode = SecurityMode.TransportWithMessageCredential;
    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
    binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows;

    return binding;
}

will work for extracting the Windows Credentials as described above, but when presenting an invalid certificate or no certificate at all are also accepted! Therefore the authentication requirement is not fulfilled. I can also add that when configured this way my implementation of X509CertificateValidator on the server-side will not trigger, hence my suspicion that the client certificate is not added.

Surely there must be some way to add a client certificate for authentication and add Windows Credentials to handle authorization in WCF? Is there any other way that I can add the certificate than adding it to the client credentials?

Thanks in advance!

Answer 1

因此，此问题的答案将是创建您自己的CustomBinding以获取 Windows Credentails 和证书验证。

Answer 2

With Web Service references you could present both a client certificate and Windows authentication credentials, so it's strange that this isn't available out of the box for WCF?

Did you implement the custom binding or have any links of examples of getting this working?

UPDATE: here's the solution to create a custom binding to get both Windows Authentication and Client Certificates. http://david-homer.blogspot.com/2021/05/using-net-wcf-basichttpbinding-to.html

Thanks,

Dave