WCF 安全性 之 自定义证书验证

案例下载

http://download.csdn.net/detail/woxpp/4113172

客户端调用代码 通过代理类

代理生成 参见

http://www.cnblogs.com/woxpp/p/6232298.html

X509证书创建

http://www.cnblogs.com/woxpp/p/6232325.html

服务端配置代码

  <system.serviceModel>
    <services>
      <service name="WcfServiceLibrary1.Service1" behaviorConfiguration="CustomBehavior">
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost:8732/WcfServiceLibrary"/>
          </baseAddresses>
        </host>
        <!-- Service Endpoints -->
        <!-- 除非完全限定，否则地址将与上面提供的基址相关 -->
        <endpoint address="net.tcp://localhost:8731/WcfServiceLibrary" binding="netTcpBinding" bindingConfiguration="TestNetTcpBinding" contract="WcfServiceLibrary1.IService1">
          <!--
              部署时，应删除或替换下列标识元素，以反映
              用来运行所部署服务的标识。删除之后，WCF 将
              自动推断相应标识。
          -->
          <identity>
            <dns value="localhost"/>
          </identity>
        </endpoint>
        <!-- Metadata Endpoints -->
        <!-- 元数据交换终结点供相应的服务用于向客户端做自我介绍。 -->
        <!-- 此终结点不使用安全绑定，应在部署前确保其安全或将其删除-->
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
      </service>
    </services>
    <bindings>
      <netTcpBinding>
        <binding name="TestNetTcpBinding">
          <security mode="Transport">
            <transport clientCredentialType="Certificate"/>
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </netTcpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="CustomBehavior">
          <!-- 为避免泄漏元数据信息，
          请在部署前将以下值设置为 false 并删除上面的元数据终结点  -->
          <serviceMetadata httpGetEnabled="True"/>
          <!-- 要接收故障异常详细信息以进行调试，
          请将以下值设置为 true。在部署前设置为 false
            以避免泄漏异常信息-->
          <serviceDebug includeExceptionDetailInFaults="False" />
          <serviceCredentials>
            <serviceCertificate findValue="TestServer" storeName="My" storeLocation="CurrentUser" x509FindType="FindBySubjectName"/>
            <clientCertificate>
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="WcfServiceLibrary1.MyX509Validator,WcfServiceLibrary1"/>
            </clientCertificate>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>

服务端自定义证书验证类

namespace WcfServiceLibrary1
{
    public class MyX509Validator : System.IdentityModel.Selectors.X509CertificateValidator
    {
        public override void Validate(X509Certificate2 certificate)
        {
            if (!certificate.Thumbprint.Equals("B9DF5B912B8CF8EAB07A7BB9B0D17694522AB0CE", StringComparison.CurrentCultureIgnoreCase))
            {
                throw new SecurityTokenException("Unknown Certificate");
            }
        }
    }
}

客户端调用代码

  private void btnTest_Click(object sender, EventArgs e)
        {
            //Service1Client client = new Service1Client();
            //txtMessage.Text = client.GetDataUsingDataContract(new WcfServiceLibrary1.CompositeType() { StringValue = "sssss" }).StringValue;

            NetTcpBinding binding2 = new NetTcpBinding();
            binding2.Security.Mode = SecurityMode.Transport;
            binding2.Security.Transport.ClientCredentialType = TcpClientCredentialType.Certificate;
            binding2.Security.Message = new MessageSecurityOverTcp() { ClientCredentialType = MessageCredentialType.Certificate };
            EndpointAddress endpoint = new EndpointAddress(new Uri("net.tcp://localhost:8731/WcfServiceLibrary"),
              EndpointIdentity.CreateDnsIdentity("TestServer"));
            ChannelFactory<IService1> factory = new ChannelFactory<IService1>(binding2, endpoint);
            factory.Credentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser, StoreName.My,
              X509FindType.FindBySubjectName, "TestServer");
            IService1 client = factory.CreateChannel();
            txtMessage.Text = client.GetDataUsingDataContract(new WcfServiceLibrary1.CompositeType() { StringValue = "sssss" }).StringValue;
            //B9DF5B912B8CF8EAB07A7BB9B0D17694522AB0CE
        }