Comment effectuer l'authentification utilisateur SSL

Question

Un certificat auto-signé est utilisé pour l'authentification dans l'application WCF. Le serveur a spécifié:

<security mode="Message">
    <message clientCredentialType="Certificate"/>
</security>
...
<clientCertificate>
  <authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>
</clientCertificate>

Le certificat est correctement activé sur le client:

<endpointBehaviors>
<behavior name="wsHttpCertificateBehavior">          
  <clientCredentials>
    <clientCertificate findValue="<Thumbprint>" storeName="My" storeLocation="LocalMachine" x509FindType="FindByThumbprint"/>    
  </clientCredentials>          
</behavior>
</endpointBehaviors>

Sur le client, le certificat est ajouté aux certificats racine approuvés. Lors de l'appel des méthodes de service, une erreur se produit: l'identité de l'utilisateur appelant n'a pas été vérifiée par le service. Je ne comprends pas ce que vous devez spécifier d'autre pour la vérification. Si vous supprimez le certificat et spécifiez

<security mode= "None"/>

le client se bloque lors de l'appel de la méthode de service. Je ne comprends pas pourquoi. Je me bats ça depuis une semaine. Aidez-moi, s'il vous plaît!

Answer 1

Ceci est une démonstration utilisant la vérification de certificat auto-signé X.509:

<system.serviceModel>
    <services>
      <service name="Microsoft.Samples.X509CertificateValidator.CalculatorService" behaviorConfiguration="CalculatorServiceBehavior">
        <!-- use host/baseAddresses to configure base address provided by host -->
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost:8001/servicemodelsamples/service"/>
          </baseAddresses>
        </host>
        <!-- use base address specified above, provide one endpoint -->
        <endpoint address="certificate" binding="wsHttpBinding" bindingConfiguration="Binding" contract="Microsoft.Samples.X509CertificateValidator.ICalculator"/>
      </service>
    </services>

    <bindings>
      <wsHttpBinding>
        <!-- X509 certificate binding -->
        <binding name="Binding">
          <security mode="Message">
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

    <behaviors>
      <serviceBehaviors>
        <behavior name="CalculatorServiceBehavior">
          <serviceDebug includeExceptionDetailInFaults="true"/>
          <serviceCredentials>
            <!-- 
            The serviceCredentials behavior allows one to specify authentication constraints on client certificates.
            -->
            <clientCertificate>
              <!-- 
              Setting the certificateValidationMode to Custom means that if the custom X509CertificateValidator
              does NOT throw an exception, then the provided certificate will be trusted without performing any
              validation beyond that performed by the custom validator. The security implications of this 
              setting should be carefully considered before using Custom in production code. 
              -->
              <authentication certificateValidationMode="Custom" customCertificateValidatorType="Microsoft.Samples.X509CertificateValidator.CustomX509CertificateValidator, service"/>
            </clientCertificate>
            <!-- 
            The serviceCredentials behavior allows one to define a service certificate.
            A service certificate is used by a client to authenticate the service and provide message protection.
            This configuration references the "localhost" certificate installed during the setup instructions.
            -->
            <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    
  </system.serviceModel>

Ceci est le fichier de configuration du service, nous devons spécifier l'emplacement du certificat.

serviceHost.Credentials.ClientCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.Custom;
              
serviceHost.Credentials.ClientCertificate.Authentication.CustomCertificateValidator = new CustomX509CertificateValidator();

Nous vérifions le certificat auto-signé.

public class CustomX509CertificateValidator : System.IdentityModel.Selectors.X509CertificateValidator
    {
        // This Validation function accepts any X.509 Certificate that is self-issued. As anyone can construct such
        // a certificate this custom validator is less secure than the default behavior provided by the
        // ChainTrust X509CertificateValidationMode. The security implications of this should be carefully 
        // considered before using this validation logic in production code. 
        public override void Validate(X509Certificate2 certificate)
        {
            // Check that we have been passed a certificate
            if (certificate == null)
                throw new ArgumentNullException("certificate");

            // Only accept self-issued certificates
            if (certificate.Subject != certificate.Issuer)
                throw new SecurityTokenException("Certificate is not self-issued");
        }
    }

Si vous avez besoin d'un exemple complet de cette démo, vous pouvez le télécharger dans ce lien:

https://www.microsoft.com/en-us/download/details.aspx?id=21459