我们有一个当前正在使用 basicHttpBinding 的服务。我们可以灵活地将其转换为 netTCPBinding。在 IIS 7 中部署它时，我们使用匿名身份验证。该服务由同一网络中 IIS 中托管的网站访问。
我们的客户对匿名身份验证提出了担忧，他不希望不需要的用户（在办公室网络中）使用它。重点是人们可以创建自己的示例网站并使用该服务。
假设我使用传输凭证类型作为“证书”，它可以满足我的要求吗？即，只有拥有客户端证书的用户才能访问该服务？您能指导我阅读任何解释如何实现它的文章吗？
<endpoint address=""
binding="basicHttpBinding"
我已经提到了以下内容
http://msdn.microsoft.com/en-us/library/ms731092.aspx
注意：IIS 中的消费网站使用 Windows 身份验证：已启用，ASP.NET 模拟：已启用
谢谢
We have a service that is currently using basicHttpBinding. We have the flexibility to convert it to netTCPBinding. While deploying it in IIS 7, we are using authentication as Anonymous. The service is accessed by a website hosted in IIS in same network.
Our client raised a concern about anonymous authentication and he doesn’t want unwanted users (in the office network) to use it. The point is people can create their own sample website and consume the service.
Suppose I am using Transport Credential Type as "Certificate", will it meet my requirement? I.e., only users having the client certifcate can access the service? Can you direct me to any article that explains how to implment it?
<endpoint address=""
binding="basicHttpBinding"
I have referred the following
http://msdn.microsoft.com/en-us/library/ms731092.aspx
Note:The consuming website in IIS uses Windows Authentication: Enabled, ASP.NET impersonation: Enabled
Thanks
发布评论
评论（2）
我的建议是转换为netTCP并使用证书身份验证。仅与访问 Web 服务的网站共享证书。以下链接将帮助您实现 WCF 中的证书安全
http://www.codeproject.com/Articles/36683/9-simple-steps-to-enable-X-509-certificates-on-WCF
My suggestion is to convert to netTCP and use the certificate authentication . Share the certificate only with the website which access the web service. Below link will help you to achieve the certificate security in WCF
http://www.codeproject.com/Articles/36683/9-simple-steps-to-enable-X-509-certificates-on-WCF
最简单的解决方案是使用
Http Headers，并在客户端发出请求时在标头中放入一些身份验证密钥。在服务器上检查请求标头中的身份验证密钥。如果未找到钥匙，则对服务进行故障排除。查看这篇文章，其中解释了如何在创建服务代理时添加标头。建议
您可以删除元数据端点（mex），设置httpGetEnabled 为
false，这样就没有人能够创建服务的代理。希望这对您有帮助。
The simplest solution can be you use
Http Headers, and put some auth key in the headers when client makes the request. On the server check the request headers for the auth key. If key is not found, fault the service. Check this post which explains how to add headers while creating proxy of the service.Suggestion
You can remove the meta data endpoint (mex), set httpGetEnabled to
false, this way nobody will able to create proxy of the service.Hope this helps you.