WCF X509 证书身份验证类型 Kerberos 到 NTLM
我在将 WCF 客户端应用程序从开发区域部署到暂存区域（与实时区域相同）时遇到问题。
在我的 ASP.NET 应用程序上。 （具有 WCF 客户端）使用应用程序池的域用户。这意味着当我验证我的 X509 证书时，它使用 Kerberos 身份验证，因为 Windows 域帐户。现在，在临时环境中，我们必须使用应用程序池的本地计算机帐户。这意味着在临时环境中，它在使用 X509 证书进行身份验证时使用 NTLM。这是行不通的。
谁能阐明解决（或解决）此问题的最佳方法是什么？
谢谢
编辑： 异常情况如下：
在 System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 小时）在 System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData、IntPtr 密码、UInt32 dwFlags、布尔 persistKeySet、 SafeCertContextHandle& pCertCtx) 在 System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData、对象密码、X509KeyStorageFlags keyStorageFlags）位于 System.Security.Cryptography.X509Certificates.X509Certificate..ctor(Byte[] rawData，字符串密码）位于 System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData，字符串密码）位于 ...CertificateManager.GetClientCertificate(typCertificateTypes 证书类型）在
：我获取的证书文件来自 SQL 数据库，而不存储在本地证书存储中。
该应用程序正在使用 WCF 客户端与使用 X509 证书的远程服务器进行通信。我们无法控制服务部分。代码/配置之间的唯一区别是 ASP.NET 应用程序池帐户。此帐户是开发版上的域用户帐户，但在 Staging 和 Prod 上是本地用户帐户。 （我知道不要问！这不是我的选择或决定:)）
I am having problem with deploying my WCF client application from Dev to Stagging area (same as live).
On my ASP.NET app. (which has WCF client) uses domain user for the application pool. This means when I am authenticating my X509 certificate it uses Kerberos authenticatiion becouse of the windows domain account. Now on the stagging environment we have to use the local machine account for application pool. This means on the stagging environment it uses NTLM when authenticate using X509 certificate. and this does not work.
Could anyone please shead some light on what is the best way to solve (or get around) this issue?
Thanks
Edit:
Exception is as follows:
at
System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32
hr) at
System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[]
rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet,
SafeCertContextHandle& pCertCtx) at
System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[]
rawData, Object password, X509KeyStorageFlags keyStorageFlags) at
System.Security.Cryptography.X509Certificates.X509Certificate..ctor(Byte[]
rawData, String password) at
System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[]
rawData, String password) at
...CertificateManager.GetClientCertificate(typCertificateTypes
CertificateType) in
Note: The certificate file that I am getting is from the SQL database and not stored on local certificate store.
The application is using WCF client to talk to a remote Server using X509 Certificate. We dont have control over the service part. Only difference between code/config is the ASP.NET application Pool account. This account is a domain user account on the dev but local user account on Stagging and Prod. (I know dont ask! It isnt my choice or decision :))
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这个描述有点不准确，不是吗？您使用什么安全模式以及安全配置中证书的意义是什么？
<罢工>
即使使用域帐户，它仍然可以使用 NTLM，因为它仍然是单环。它在临时环境中不起作用的原因是因为托管服务的服务器不知道托管服务客户端的服务器的本地用户。您可以尝试丑陋的黑客：在第二台服务器上创建一个具有完全相同的用户名和密码的本地用户。但这只是浪费时间，因为您可以以同样的方式简单地关闭身份验证，因为：
不反映生产环境的临时环境无用。一旦它不反映真实环境，它就不再取决于您是否使用不同的身份验证机制或根本不使用身份验证。如果您计划在生产中使用域帐户和 Kerberos，您必须拥有包含测试域和配置的 Kerberos 的临时环境。否则你根本不必使用登台，因为无论如何你都会修复生产中真正的集成错误。好吧，所以你的问题很模糊，因为它显然与帐户无关，而且 WCF 的安全性也不是完全受 Kerberos 或 NTLM 影响，因为您正在使用客户端证书对服务进行身份验证，不是吗？异常堆栈跟踪表明您的代码无法从原始数据（从 SQL 服务器加载？）创建有效的证书。因此，要么 SQL 数据库中的数据不正确，要么密码不正确，要么您没有正确加载数据。
That is little bit inaccurate description isn't it? What security mode are you using and what is the point of certificate in your security configuration?
Even with domain account it can still use NTLM because it is still single hoop. The reason why it doesn't work in staging environment is because the server hosting the service doesn't know the local user of the server hosting the service's client. You can try ugly hack: on the second server create a local user with exactly same user name and password. But it is just waste of time because you can in the same way simply turn off authentication because:
A staging environment which doesn't reflect production environment is useless. Once it doesn't reflect real environment it doesn't depend if you use different authentication mechanism or if you don't use authentication at all. If you plan to use domain account and Kerberos in production you must have staging environment with test domain and configured Kerberos. Otherwise you don't have to use staging at all because you will fix real integration errors in production anyway.Ok, so your question is blurred because it obviously doesn't have nothing to do with account and WCF's security is not affected by Kerberos or NTLM at all because you are using client certificate to authenticate to the service, aren't you? The exception stack trace says that your code is unable to create valid certificate from raw data (loaded from SQL server?). So either data in SQL database are not correct, password is not correct or you didn't load data correctly.
当您的 ASP.net 应用程序运行所在的应用程序池无法访问您想要为 WCF 服务调用附加的客户端证书的私钥时，通常会出现此错误。请确保应用程序池身份有权访问证书私钥。您还可以粘贴您用来加载证书并将其附加到 WCF 服务调用的代码吗？
This error typically comes when the application pool under which ur ASP.net application runs doesn't have access to the private key of the client certificate that u want to attach for WCF service call. Please make sure that the application pool identity has access to the certificates private key. Also can you paste the code that you are u using to load and attach the certificate to the WCF service call.