如何为需要客户端身份验证证书的 Web 服务添加对 WCF 客户端的服务引用

Question

Caution, WCF noobie alert

I need to create a WCF client to query a non-WCF web service. The web service is not a WCF service. Additionally, the web service requires a client authentication certificate. Now, I have the certificate, and can create a non-WCF client that works perfectly; I was able to 'Add Web Reference' and a certificate dialog box opened up to allow me to select the appropriate certificate, then went on to create the web reference. Trying to create a WCF client via 'Add Service Reference' is another story, it just fails with a 403 Access Denied error.

I have the WSDL for the service, and have run svcutil.exe on it, but am not sure how to proceed from there.

Thanks for any help!

Answer 1

I know this is the old question and it has been already solved but I would like to mention that Add service reference also works for WSDL files stored on disk. Marc has also mentioned it. Add service reference dialog accepts:

• URL to WSDL
• URL to Metadata exchange endpoint
• Service URL where /mex is added internally
• Any file path to WSDL file

So if you have WSDL and all need XSD files you can use Add service reference as well. The only tricky part is that Add service reference dialog doesn't have Browse button and that is the reason why this functionality is not well known.

Answer 2

I'm assuming that the service you are using is performing client SSL authentication.

Since add service reference is failing, you can use svcutil to generate the client from the WSDL file that you have. I think the syntax would be something like:

svcutil *.wsdl /l:C# /out:Reference.cs /config /s /ct:System.Collections.Generic.List`1 /ser:Auto /tcv:Version35 /n:*,<NameOfYourNamespaceHere> /edb

This will generate a file, Reference.cs, that contains the proxy classes to the service (you can give this file whatever name you want). Add this file to your project. A config file, output.config, will also be generated. You can add this configuration to your application configuration instead of typing it all in by hand.

Now you can follow this MSDN article on using Transport Security with Certificate Authentication . You can skip down to the client section where it shows how to attach the certificate to the request in code as well as in configuration.

Good luck.

Answer 3

Stupid question (maybe): could you connect to the service endpoint, present it with your credentials stored in the certificate, and then download the WSDL (and possibly XSD) from there? Or could it be the entity offering this service would be able to actually send you these files (or make them available for download)?

Once you have the WSDL (and XSD) file on disk, it should be easy enough to create WCF client for that (using either svcutil.exe or Add Service Reference ) based on those files, and then configure the appropriate security for it.

Just a thought.... (worth $0.02?)

Marc

Answer 4

OK, bit of a work-around here (and I've no idea what is going on technically): I noticed that when you add a Web Reference, the certificate you have chosen is cached and automatically used the next time you add the Web Reference (I noticed because I'd chosen the wrong certificate). This caching seems to work across Web Reference and Service Reference so:

• Add a Web Reference to the endpoint, choosing the certificate you wish to use
• Remove this Web Reference
• Add a Service Reference to the same endpoint and Visual Studio will use the same certificate you chose for the Web Reference

Worked on Visual Studio Community 2019, v16.7.7