Wcf配置系列2－－basicHttpBinding with MessageSecurity

上一篇介绍了不带安全配置的basicHttpBinding，basicHttpBinding的security mode 可以设置为以下值：

　　　Message, Transport, TransportWithMessageCredential, TransportCredentialOnly 和 None

本篇介绍security mode 为Message　且clientCredentialType为"Certificate"　的binding配置。

在服务端app.config文件中，在endpoint 中指定了basicHttpBinding并且指向一个名为Binding1的binding configuration ，如下的示：

 

<service name="Microsoft.Samples.MessageSecurity.CalculatorService" behaviorConfiguration="CalculatorServiceBehavior">
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost:8000/ServiceModelSamples/service"/>
          </baseAddresses>
        </host>
        <!-- this endpoint is exposed at the base address provided by host: http://localhost:8000/ServiceModelSamples/service  -->
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="Binding1" contract="Microsoft.Samples.MessageSecurity.ICalculator"/>
        <!-- the mex endpoint is exposed at http://localhost:8000/ServiceModelSamples/service/mex -->
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
      </service>

 

在 binding configuration 中则可以指定我们需要的配置：security mode 为Message　且clientCredentialType为"Certificate"。如下所示：

 

<basicHttpBinding>
        <!-- 
        This configuration defines the SecurityMode as Message and 
        the clientCredentialType as Certificate.
        -->
        <binding name="Binding1">
          <security mode="Message">
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </basicHttpBinding>

服务端用来让客户端验证自己的证书配置在behaviors节点的serviceCredentials 元素中（同样，客户端用来　让服务端认证证书配置客户端配置文件的

behaviors节点的clientCertificate 元素中）。如下所示：

 

<behaviors>
      <serviceBehaviors>
        <behavior name="CalculatorServiceBehavior">
          <serviceMetadata httpGetEnabled="True"/>
          <serviceDebug includeExceptionDetailInFaults="False"/>
          <!--
        The serviceCredentials behavior allows one to define a service certificate.
        A service certificate is used by a client to authenticate the service and provide message protection.
        This configuration references the "localhost" certificate installed during the setup instructions.
        -->
          <serviceCredentials>
            <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
            <clientCertificate>
              <!-- 
            Setting the certificateValidationMode to PeerOrChainTrust means that if the certificate 
            is in the user's Trusted People store, then it will be trusted without performing a
            validation of the certificate's issuer chain. This setting is used here for convenience so that the 
            sample can be run without having to have certificates issued by a certificate authority (CA).
            This setting is less secure than the default, ChainTrust. The security implications of this 
            setting should be carefully considered before using PeerOrChainTrust in production code. 
            -->
              <authentication certificateValidationMode="PeerOrChainTrust"/>
            </clientCertificate>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>

其中<authentication certificateValidationMode="PeerOrChainTrust" />应只在开发环境中使用。

 

在客户端的配置必须和服务器端保持一样。如下所示：

 

<client>
      <!-- Use a behavior to configure the client certificate to present to the service. -->
      <endpoint name="" address="http://localhost:8000/servicemodelsamples/service" binding="basicHttpBinding" bindingConfiguration="Binding1" behaviorConfiguration="ClientCertificateBehavior" contract="Microsoft.Samples.MessageSecurity.ICalculator"/>
    </client>

 

<basicHttpBinding>
        <!-- 
        This configuration defines the SecurityMode as Message and 
        the clientCredentialType as Certificate.
        -->
        <binding name="Binding1">
          <security mode="Message">
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </basicHttpBinding>

 

<behaviors>
      <endpointBehaviors>
        <behavior name="ClientCertificateBehavior">
          <!--
        The clientCredentials behavior allows one to define a certificate to present to a service.
        A certificate is used by a service to authenticate the client and provides message protection.
        This configuration references the "client.com" certificate installed during the setup instructions.
        -->
          <clientCredentials>
            <clientCertificate findValue="client.com" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName"/>
            <serviceCertificate>
              <!-- 
            Setting the certificateValidationMode to PeerOrChainTrust means that if the certificate 
            is in the user's Trusted People store, then it will be trusted without performing a
            validation of the certificate's issuer chain. This setting is used here for convenience so that the 
            sample can be run without having to have certificates issued by a certificate authority (CA).
            This setting is less secure than the default, ChainTrust. The security implications of this 
            setting should be carefully considered before using PeerOrChainTrust in production code. 
            -->
              <authentication certificateValidationMode="PeerOrChainTrust"/>
              <defaultCertificate findValue="localhost" storeLocation="CurrentUser" storeName="TrustedPeople" x509FindType="FindBySubjectName"/>
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>

 

案例运行步骤（仅服务端和客户端在同一机器上运行）：

1. 通过SDK cmd工具运行setup.bat，这将安装案例所需的所有证书。

2. 从service\bin运行服务端应用程序。

3. 从client\bin运行客户端应用程序，客户端的活动将显示在控制台中。

4. 通过SDK cmd工具运行 Cleanup.bat ，这会移除案例所需的所有证书。

案例下载