Alex Rivera | Logout

WCF service certificate and client side endpoint identity - why it doesn't work?

Asked 2009-11-09T14:43:22.787
10

[Update] - I attach also full config files, for service, and for client (outside of here, not to flood the topic)

I'm having situation pretty much identical to the one outlined in this question, however my question is somewhat different.

  • I'm using NetTcpBinding with security set to TransportWithMessageCredential
  • I'm using Password/Username credentials backed up by ASP.NET provider
  • My service is self hosted in Windows Service
  • I do have in my endpoint behavior specified authentication revocationMode="NoCheck"

It is required that the service provides a certificate to authenticate itself to clients. That's OK, I just do:

<serviceCertificate findValue="***"
                    storeLocation="CurrentUser"
                    storeName="My"
                    x509FindType="FindByThumbprint"/>

Now, I somewhat imagined that now the client would end up having

<identity>
  <certificate encodedValue="encoded certificate"/>
</identity>

And it will be able to verify service's credentials without having that certificate installed in the store on client machine.

I was surprised to learn that although I set the service credentials to certificate, WSDL exposes 

<Identity>
   <Dns>Foo</Dns>
</Identity>

Again, on service I can set Identity to CertificateReference an

wcf security certificate
Edit
Report

2 Answers

4

Solution sketch:

1) Define and register a custom X509CertificateValidator on the client

2) In the Validate method, compare the given certificate with the one present in the client's EndpointAddress.Identity property. The object referenced by this property should have the X509CertificateEndpointIdentity exact type.

I didn't test this solution, however it makes perfect sense to me.

HTH Pedro

answered 2009-11-09T23:09:21.487
1

This is an additional comment to my previous answer. Sorry I cannot comment answers.

Moreover you do not need to set any identity on the server. Forget about what WSDL tells you about the identity of the server. The identity of a remote service endpoint is decided by the client during runtime. If the server uses SSL then it has several identities: the common name of the certificate (i.e. a DNS identity), a certificate identity and an RSA identity (not sure about the last one). Therefore, you can check the server's identity by anyone of these criteria (or by several of them).

answered 2011-03-10T13:02:59.307

Your Answer