I am trying to build a proof of concept of a WCF service utilisting a
wsHttpBinding with Transport Certificate security. I am having problems
connecting to it with a console client - everytime I try to open the channel
I get the following error: Forbidden with client authentication scheme
'Anonymous'
InnerException: The remote server returned an error: (403) Forbidden
I have taken the following steps to set up the server:
* Acquired a verisign certificate registered to the machines dns address
* Installed the certificate into the certificate stores (CurrentUser and
LocalMachine) under Personal and Trusted People
* Used Httpcfg to setup the following port with SSL :
IP : 0.0.0.0:7000
Hash : fb29ea4bdb5378b 2cc 2f1f7ece056dd48 8db47c
Guid : {00000000-0000-0000-0000-000000000000}
CertStoreName : MY
CertCheckMode : 0
RevocationFresh nessTime : 0
UrlRetrievalTim eout : 0
SslCtlIdentifie r : (null)
SslCtlStoreName : (null)
Flags : 2
------------------------------------------------------------------------------
* Created a console application with a very simple WCF service contract and
the following configuration file:
<?xml version="1.0" encoding="utf-8" ?>
<configuratio n>
<system.service Model>
<behaviors>
<serviceBehavio rs>
<behavior name="NewBehavi or">
<serviceMetadat a httpsGetEnabled ="true" />
<serviceCredent ials>
<clientCertific ate>
<authenticati on certificateVali dationMode="Pee rOrChainTrust"/>
</clientCertifica te>
</serviceCredenti als>
</behavior>
</serviceBehavior s>
</behaviors>
<bindings>
<wsHttpBindin g>
<binding name="Binding">
<security mode="Transport ">
<transport clientCredentia lType="Certific ate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<services>
<service behaviorConfigu ration="NewBeha vior"
name="WcfSelfHo stedPOC.TestSer vice">
<endpoint address="https://servername:7000/TestService"
binding="wsHttp Binding"
bindingConfigur ation="Binding" name="TestServi ce.Http"
contract="WcfSe lfHostedPOC.ITe stService" />
<host>
<baseAddresse s >
<add baseAddress="ht tps://servername:7000/TestService"/>
</baseAddresses>
</host>
</service>
</services>
</system.serviceM odel>
</configuration>
* Created a console client with the following configuration file:
<?xml version="1.0" encoding="utf-8" ?>
<configuratio n>
<system.service Model>
<bindings>
<wsHttpBindin g>
<binding name="TestServi ce.Http" >
<security mode="Transport ">
<transport clientCredentia lType="Certific ate"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="https://servername:7000/TestService"
binding="wsHttp Binding"
bindingConfigur ation="TestServ ice.Http"
contract="Servi ceReference1.IT estService"
name="TestServi ce.Http" />
</client>
</system.serviceM odel>
</configuration>
And a simple client with the following code:
static void Main(string[] args)
{
ServiceReferenc e1.TestServiceC lient client = new
WcfSelfHostedPO CClient.Service Reference1.Test ServiceClient() ;
client.ClientCr edentials.Clien tCertificate.Se tCertificate(St oreLocation.Cur rentUser,
StoreName.My,
X509FindType.Fi ndByThumbprint,
"fb 29 ea 4b db 53 78 b2 cc 02 f1 f7 ec e0 56 dd 48 8d b4
7c");
client.DoWork() ;
Console.WriteLi ne("Yay!");
client.Close();
}
It always falls over with the DoWork() call with the forementioned error. I
have checked in the debugger and and the referenced certificated was loaded
correctly.
The same service worked with Basic authentication enabled and I can access
the metadatapage if I specify the nominated certificate through the browser.
I can also add a service reference from the client project.
Have I missed anything?
Many thanks,
--
Tim Eckersley
