我尝试了许多不同的方法,但都没有成功(我无法找到与我尝试做的完全相同的例子)。每次当我认为我接近成功时,我都会在调用服务时在客户端中遇到异常。我遇到的最常见的异常是:
“The HTTP request was forbidden with client authentication scheme 'Anonymous'.”
Inner exception: "The remote server returned an error: (403) Forbidden."
有没有人对我可能做错了什么或者更好的设置双向 SSL 的步骤有任何想法?
完全披露 - 我现在在同一台计算机上运行客户端和服务器。不确定这是否重要。
下面是配置片段。
服务和客户端代码相对简单,所以我相当有信心让它们正常工作。应用配置文件(特别是绑定和行为)和证书则“更有趣”,因此我对其不太自信。
以下是我如何创建证书(实际命令逐字逐句)。
makecert -pe -n "CN=SelfSignedCA" -ss Root -sr LocalMachine -a sha1 -sky signature -r -sv "SelfSignedCA.cer" "SelfSignedCA.pvk"
makecert -pe -n "CN=system" -ss my -sr LocalMachine -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -in "SelfSignedCA" -is Root -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 Service.cer
makecert -pe -n "CN=client1" -ss my -sr LocalMachine -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1 -in "SelfSignedCA" -is Root -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 Client1.cer
关联证书和端口(实际命令照字面意思)
netsh http add urlacl url=https://+:44355/MyService/ user=EVERYONE
服务器设置
绑定:
<wsHttpBinding>
<binding name="CustomBinding">
<security mode="Transport">
<transport clientCredentialType="Certificate"/>
</security>
</binding>
</wsHttpBinding>
行为:
<serviceBehaviors>
<behavior name="">
<!--
<serviceCredentials>
<serviceCertificate
findValue="system"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName"/>
</serviceCredentials>
-->
<serviceAuthorization
serviceAuthorizationManagerType=
"ClientAuthorization.ClientCertificateAuthorizationManager, Simulator.Service.SideA" />
</behavior>
</serviceBehaviors>
客户端
绑定:
<wsHttpBinding>
<binding name="CustomBinding">
<security mode="Transport">
<transport clientCredentialType="Certificate"/>
</security>
</binding>
</wsHttpBinding>
行为
<endpointBehaviors>
<behavior name="ChannelManagerBehavior">
<clientCredentials>
<clientCertificate findValue="client1"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName" />
<!--
<serviceCertificate>
<authentication certificateValidationMode="PeerOrChainTrust"/>
</serviceCertificate>
-->
</clientCredentials>
</behavior>
</endpointBehaviors>
更新
我在服务器上添加了自定义的用户名和密码验证器,试图覆盖默认行为并始终允许无论提供的凭据如何(我真的不想进行用户名/密码验证)。这个验证器从未被调用。客户端仍然会收到“身份验证方案 '匿名'。”异常。
服务行为更新
<serviceCredentials>
<userNameAuthentication
userNamePasswordValidationMode="Custom"
customUserNamePasswordValidatorType=
"Service.ClientAuthorization.ClientUserNamePasswordValidatorManager, Service.SideA" />
</serviceCredentials>