仅具有服务证书的 WCF 消息安全
我是 WCF 新手，想知道是否可以执行消息安全性，我仅将 x.509 证书用于服务，并且为了客户端安全而使用 Windows 凭据，这是否可以接受，是否有效？尝试在网上搜索，但要么没有关于这种方法的讨论，要么我在谷歌搜索中输入了错误的措辞，非常感谢任何帮助，谢谢大家。
基本上，我的绑定中有这个：
<wsHttpBinding>
<binding name="msgBinding">
<security mode="Message">
<message clientCredentialType="Windows" />
</security>
</binding>
</wsHttpBinding>
以及我的行为：
<behavior name="wsHttpCertificateBehavior">
...
<serviceCredentials>
<serviceCertificate findValue="MyCert" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="My" />
</serviceCredentials>
</behavior>
I'm new to WCF, and wanted to know if it is possible to do Message Security, where I use a x.509 certificate for the service only, and for client security do windows credentials, is this acceptable, does it work? Tried searching the web, but either no discuss on this approach exists, or I have put the wrong wording in my google search, any help is much appreciated, thank you all.
basically, I'd have this in my binding:
<wsHttpBinding>
<binding name="msgBinding">
<security mode="Message">
<message clientCredentialType="Windows" />
</security>
</binding>
</wsHttpBinding>
and on my behavior:
<behavior name="wsHttpCertificateBehavior">
...
<serviceCredentials>
<serviceCertificate findValue="MyCert" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="My" />
</serviceCredentials>
</behavior>
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
你为什么要尝试这样做？您的安全要求是什么？
您是否尝试使用服务证书来保护消息传输，然后使用客户端的 Windows 安全性进行身份验证和授权？
仅当您位于同一域或设置了某种联合安全性时，Windows 安全性才起作用。如果您位于同一域，则只需对两者使用 Windows 安全性。如果您不在同一域中，则无法对客户端使用 Windows 凭据，因为服务器将无法验证它们。您必须使用由服务端的证书颁发机构颁发的客户端证书或使用自定义凭据。
但是，如果您位于同一域但仍然需要服务端证书，那么您必须在服务的配置文件中指定 serviceCertificate 并使用 HTTPS 定义端点地址，也就是说，如果您作为独立服务托管。如果您在 IIS 中托管，则可以在 IIS 网站的设置中定义证书。
您可能会发现此应用程序部署方案很有用
Why are you trying to do this? What are your security requirements?
Are you trying to use a Service Cert to secure the message transfer and then use windows security for the client for authentication and authorization?
Windows security only works if you are on the same domain or have some sort of federated security set up. If you are on the same domain just use windows security for both. If you are not on the same domain then you can't use windows credentials for the client because the server will have no way of validating them. You would either have to use a client certificate that was issued by the certificate authority on your service side or use custom credentials.
If however you are on the same domain but still require a service side cert then you have to specify the serviceCertificate in the service's config file and define an endpoint address with HTTPS, that is if you are hosting as a stand alone service. If you are hosting in IIS then you define the certifice in the IIS website's setup.
You may find this useful Application Deployment Scenarios
嘿，谢谢你对莫古努斯的帮助。我的问题非常复杂，但简而言之，我的要求是在服务器端使用证书，在做了更多研究之后，我想我现在已经弄清楚了。因此，如果我理解正确，当在具有消息安全性的客户端/服务器上使用证书时，客户端将使用其私钥对消息进行签名，然后附加其发布密钥，并使用服务器的发布密钥进行加密，只有服务器能够解密并获取签名消息以及客户端的公钥以验证签名数据。
就我而言，我让它工作了，我只需要验证服务是否使用正确的东西来签名/加密，但这似乎不可能，因为当消息打包时，它已经被加密并且我看不到内容。
我在搜索这个答案时意识到的另一个问题是，并非所有客户端都位于同一域中，因此必须在客户端使用用户/密码或证书。
Hey thank you for your help Mogounus. My problem is quite complicated, but in short, my requirements are to use certs on the server side, after doing some more research i think i figured it out now. So if I understand it correctly, when using certs on both client/server with message security, the client would sign the message with its private key, then attach its pub key, and encrypt with the server's pub key, only the server would be able to decrypt and thus get the signed message along with the pub key of the client to verify the signed data.
In my case, I had it working, I just needed to verify that the service was using the right stuff to sign/encrypt, but this doesn't seem possible since by the time the message is packaged up, it is already encrypted and i can't see the content.
Another problem I realized while searching for this answer is, not all my clients will be in same domain, so will have to either use user/pwd or certs on the client side.