WCF WsHttpBinding 证书传输安全 - Windows 证书配置
我有两个使用 WsHttpBinding 和传输安全相互证书身份验证的 WCF 服务，它们托管在同一 Windows 服务器上。可以访问一项 WCF 服务的客户端不应访问另一项 WCF 服务。我需要一些有关在 Windows 主机上配置客户端证书的帮助。客户端证书由受信任的 CA 签名，中间证书链和根证书链已安装在服务器上。看起来该服务自动依赖于信任链，并且在让客户端访问服务之前根本不需要在服务器上安装实际的客户端证书 - 这不是我想要的行为。有人可以告诉我应该如何配置这些客户端证书才能明确允许访问一项服务而不是另一项服务吗？
谢谢。
I have two WCF Services using WsHttpBinding with transport security mutual certificate authentication that are being hosted on the same windows server. Clients that can access one WCF service should not have access to the other WCF service. I need some help on configuring the client certificates on the windows host. The client certificates are signed by trusted CAs and the intermediate and root certificate chain is already installed on the the server. It seems like the service automatically relies on chain of trust and does not require the actual client certificates installed on the server at all before letting the client access the service - this is not the behavior I want. Can someone please tell me how I should be configuring these client certificates in order explicitly allow access to one service and not the other?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这与证书本身无关。使用相互 SSL 身份验证时，证书仅用于对客户端进行身份验证，并且身份验证是在应用程序外部完成的（这与您可以创建自定义证书验证器的消息安全性不同）。一旦证书受到信任，客户端就会使用证书进行身份验证，自动对服务器上的任何内容进行身份验证。
您正在寻找授权 - 您定义经过身份验证的客户端可以使用您的服务执行哪些操作的步骤。您可以使用基于角色的安全性将授权逻辑硬编码到您的服务中或者您可以实现两个自定义
ServiceAuthorizationManager并将每个分配给单个服务。That has nothing to do with certificates themselves. When using mutual SSL authentication certificates are used only to authenticate client and the authentication is done outside of your application (this is difference to message security where you can create custom certificate validator). Once certificate is trusted client is automatically authenticated to anything on the server using certificates for authentication.
You are looking for authorization - the step where you define what can authenticated client do with your service. You can either hardcode your authorization logic into your service by using role based security or you can implement two custom
ServiceAuthorizationManagers and assign each to single service.