2向SSL身份验证和请求授权

Question

I am starting to develop a RESTful API (with WCF) which will be working in 2Way SSL authentication - client side certifications and server side certification.

As I understand, there will be no need for password/username because the client is already authenticated by the client-side certificate.

My problem is that some of the exposed methods should be restricted to specific clients only.

So, I also need some form of authorization. I thought about using a secret key which will be supplied to clients which are authorized of specific functions, but then I realized that this clients will already be having client-side certificates which can possibly be used for authorization.

Is there any way to get the name of the currently used client-side certificate in a programmatic way and then authorize by the certificate name?

somethine like this:

string clientCertificate = CertificateAuthority.GetCurrentCertificate;
if (Authorize(clientCertificate))
     doSomething()

Answer 1

Yes there are such methods, most noticeable the X509Certificate2.GetNameInfo Method .
(BTW, Dominick Baier has an excellent fluent API extension for that)

However, I think you should take a look at Claims-Based Identity which will give you a much simplified code architecture.

Answer 2

The identity of the certificate holder is in the SubjectDN of the certificate.

The remainder, the authorization part, is application-dependent and varies with your architecture too. For example, if you are using LDAP you would lookup that user's roles.