使用WSHttpBinding时如何限制对本地计算机的WCF服务的访问？

Question

I'm using WCF to do inter-process communication on my machine, using WSHttpBinding, and I'd like to restrict the service so only processes on the current machine can call the service. How can I do this?

I would prefer to use NetNamedPipesBinding which inherently would perform this restriction, however this is not possible in my scenario, so I'd like a way to restrict it using WSHttpBinding. The reason I can't use NetNamedPipesBinding is that one of the clients to the service is running within a low-integrity process (Internet Explorer in Protected Mode) and doesn't have access to connect to a higher-integrity named pipe (without a lot of undocumented jiggery-pokery like this which looks good but I'd prefer to avoid).

One option would be to add an IDispatchMessageInspector that restricts by IP Address as described here . Is that the best approach?

UPDATE: This software will be deployed to hundreds of machines, so a solution like using certificates would likely be more work than desired.

Answer 1

You could try using X509 certificates to create a security signature. That way, you can hold the lock and the key. Other IPs would be able to hit your service, but not communicate. You could do something like:

In the Service:

          <behaviors>
  <serviceBehaviors>
    <behavior name="wsHttpCertificateBehavior">
      <dataContractSerializer maxItemsInObjectGraph="50000"/>
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false" />
      <serviceCredentials>
        <clientCertificate>
          <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" />
        </clientCertificate>
        <serviceCertificate findValue="CN=WSE2QuickStartServer" storeLocation="LocalMachine"
          storeName="My" x509FindType="FindBySubjectDistinguishedName" />
      </serviceCredentials>
    </behavior>
    <behavior name="">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="false" />
    </behavior>
  </serviceBehaviors>
</behaviors>

In the Client:

    <behaviors>
  <endpointBehaviors>
    <behavior name="wsHttpCertificateBehavior">
      <dataContractSerializer maxItemsInObjectGraph="50000" />
      <clientCredentials>
        <clientCertificate findValue="CN=WSE2QuickStartClient" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectDistinguishedName" />
        <serviceCertificate>
          <authentication certificateValidationMode="ChainTrust" revocationMode="NoCheck" trustedStoreLocation="LocalMachine" />
        </serviceCertificate>
      </clientCredentials>
    </behavior>
  </endpointBehaviors>
</behaviors>

<client>
  <endpoint address="https://localhost/ClientService.svc" behaviorConfiguration="wsHttpCertificateBehavior" binding="wsHttpBinding" bindingConfiguration="ApplicationServicesBinding" contract="GAINABSApplicationServices.Contracts.ServiceContracts.IClientService" name="ClientService">
    <!--<identity>
      <certificateReference storeName="AddressBook" storeLocation="CurrentUser"
        x509FindType="FindBySubjectName" findValue="WSE2QuickStartServer"
        isChainIncluded="true" />
    </identity>-->
  </endpoint>
 </client>

You may optionally need the Identity tag on the client to state that you are explicitly using the cert for the identity when communicating with the service. Hope this helps!