WCF：尝试使用自签名证书和'PeerTrust'设置双向相互SSL身份验证

Question

我正在尝试使用相互SSL身份验证在同一台计算机上设置WCF服务和客户端。

我有：

• 为服务器和客户端创建证书，并将它们放在LocalMachine证书库中。 服务器和客户端私钥位于“个人”存储中，而公钥位于“受信任的人”存储中。

• 我已经配置了一个WCF服务和客户端，每个服务和客户端都指定了来自商店的自己的证书引用，并且还设置了要使用的其他方证书引用进行验证

<authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine" />

注意：服务器证书颁发给计算机名称，客户端调用的服务URL为“https：\\ tokenservice \\ tokenservice.svc”

使用此配置，我希望客户端安全地连接到服务，任何一端解析来自“受信任的人”存储的证书，但是我收到以下错误，表明证书验证失败：

[AuthenticationException：根据验证过程，远程证书无效。]

所以这并没有像我预期的那样真正起作用。 任何人都可以指出任何错误吗？ 或者我的期望不正确？

WCF配置如下：

    <?xml version="1.0"?>
<configuration>
  <system.web>
    <compilation debug="true" targetFramework="4.0" />
  </system.web>
  <system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="CertificateForClient">
          <security mode="Transport">
            <transport clientCredentialType="Certificate"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="CertificateBehaviour">
          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="true"/>
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="true"/>
          <serviceCredentials>
            <clientCertificate>
              <authentication certificateValidationMode="PeerTrust"
                              trustedStoreLocation="LocalMachine" />
            </clientCertificate>
            <serviceCertificate findValue="CN='ServerCertificate which is machine name'"
            storeLocation="LocalMachine" storeName="My"
            x509FindType="FindBySubjectDistinguishedName" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <services>
      <service name="TokenService.TokenService" behaviorConfiguration="CertificateBehaviour">
        <endpoint contract="TokenService.ITokenService"
            binding="wsHttpBinding" />
        <endpoint contract="IMetadataExchange"
            binding="mexHttpBinding" address="mex">
        </endpoint>
        <host>
          <baseAddresses>
            <add baseAddress="https://tokenservice" />
          </baseAddresses>
        </host>
      </service>
    </services>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
 <system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>

</configuration>

客户端配置：

  <system.serviceModel>
<behaviors>
  <endpointBehaviors>
    <behavior name="ClientBehaviour">
      <clientCredentials>
        <clientCertificate storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName" findValue="CN=TokenClient"/>
        <serviceCertificate>
          <authentication certificateValidationMode="PeerTrust" trustedStoreLocation="LocalMachine"></authentication>
        </serviceCertificate>
      </clientCredentials>
    </behavior>
  </endpointBehaviors>
</behaviors>
<bindings>
  <wsHttpBinding>
    <binding name="ClientBinding">
      <security mode="Transport">
        <transport clientCredentialType="Certificate"/>
      </security>
    </binding>
  </wsHttpBinding>
</bindings>
<client>
  <endpoint address="https://tokenservice/TokenService.svc"
    behaviorConfiguration="ClientBehaviour"
    binding="wsHttpBinding" bindingConfiguration="ClientBinding"
    contract="TokenService.ITokenService" name="ToolClient">
    <identity>
      <dns value="MachineName" />
    </identity>
  </endpoint>
</client>

Answer 1

当使用相互SSL在传输层完成身份验证时，PeerTrust和ChainTrust提供的内置授权不起作用。

说实话，PeerTrust在许多情况下并不能控制所需的授权过程。

解决此问题的一种常见方法是插入自定义ServiceAuthorizationManager并覆盖其OnAccess方法。

<behavior name="ServerCertificateBehavior">
  <serviceCredentials>
    <serviceCertificate ....  />
  </serviceCredentials>
  <serviceAuthorization serviceAuthorizationManagerType="MyCustomCertificateAuthorizationManager, MyWCFExtensions.Security" />
</behavior>

ServiceAuthorizationManager可以在几行代码中完成，以进行非常静态的简单证书检查，或者根据需要进行更复杂的检查。

这个简单的概念验证有望帮助您入门：

public class MyCustomCertificateAuthorizationManager : ServiceAuthorizationManager
{

    public override bool CheckAccess(OperationContext operationContext, ref Message message)
    {
        base.CheckAccess(operationContext, ref message);
        string action = operationContext.IncomingMessageHeaders.Action;

        List<string> approvedActions = new List<string> 
        { 
            "http://kramerica.lan/namespace/MySpecialMethod",
            "http://kramerica.lan/namespace/AnotherMethod"
        };

        List<string> approvedThumbprints = new List<string> 
        { 
            "‎1aaffe105b31b79b66c31de3389203d42351683a",
            "‎f1bcfbc6383bcbfa736473bcaf109987bbc2121a"
        };


        //One way is do the authorization based on the action if the endpoint is used for more than one operation with different ACL needs
        if (approvedActions.Contains(action))
        {
            foreach (ClaimSet claimSet in OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets)
            {
                X509CertificateClaimSet certificateClaimSet = claimSet as X509CertificateClaimSet;
                if (certificateClaimSet != null)
                {
                    //Get the actual certificate used by the client
                    X509Certificate2 certificate = certificateClaimSet.X509Certificate;

                    //Here a real validation of certificate issuer chain etc. could be made
                    if (certificate != null)
                    {
                        //This proof-of-concept does authorization based on a static list of thumbprints but about anything os possible here.
                        //One could easily check if this certificate
                        //is present in the TrustedPeople store or some database backend
                        if (approvedThumbprints.Contains(certificate.Thumbprint))
                            return true;
                    }
                }
            }
        }
        return false;
    }
}

Answer 2

服务的基本URL应该是服务器证书名称。

例如：

如果我的服务器证书名称是test.cer，那么我的服务URL应该是https：//test/MyService/MyService.svc 。

这是您设置服务的方式吗？