WCF auth peek

The default wsHttpBinding is perfect for intranet application scenario, if all users are login throug a LDAP server. Client side already authenticated the user, on server side, services only need to grap  the client user windows login (with domain).

Thread.CurrentPrincipal.Identity.Name

In UserName auth mode, this becomes a blank string, to get user id inputted in some kind of login page, call:

ServiceSecurityContext.Current.PrimaryIdentity.Name

UserName auth mode should be used for internet scenario, WCF uses the X509 certificate to protect the message transfered over plain HTTP.  Service side need to generate the certificate by running: (in C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bin )

makecert.exe -sr LocalMachine -ss My -a sha1 -n CN=MyServerCert -sky exchange –pe

Then configure certificate in web.config:

<behavior name="customUserName">
	<serviceDebug includeExceptionDetailInFaults="true"/>
	<serviceMetadata httpGetEnabled="true"/>
	<serviceCredentials>
		<serviceCertificate
			findValue="MyServerCert"
			x509FindType="FindBySubjectName"
			storeLocation="LocalMachine"
			storeName="My"
		/>
 	</serviceCredentials>
</behavior> 

Got “keyset does not exist” error then, had to give read permission to the account to server the www service, either ASPNET or NETWORK SERVICE. Make sure you get the right key file, I couldn’t make cacls work with folder.

cacls.exe "C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\your-key-file" /E /G "ASPNET":R
cacls.exe "C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\your-key-file" /E /G "NETWORK SERVICE":R

Client side has 5 options to choose as the WSHttpbinding behavior:

        <behavior name="PeerTrustClient">
          <clientCredentials>
            <serviceCertificate>
              <authentication certificateValidationMode="PeerTrust"  />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
            <!-- None, ChainTrust, or Custom-->

  1. None.

    Skip the certificate check, client doesn't care if the host is the REAL service provider. Some hackers could resolve chient's address and redirect the call to a malicious service.

  2. PeerTrust

    Certificate (exported private key?) installed in the client\'s Trusted People store. Maybe double click the certificate file can do the job.

  3. ChianTrust

    Certificate issued by a root authority (can get a trial one from Thawte). I haven\'t figure this out yet, \'Windows does not have enough information to verify this certificate\'. Downloaded and installed the Thawte test CA root certificate, same problem.

    Switched to SSL Web Server Certificate, the default was SGC Supercert, which needs a Thawte Test Intermediate CA I couldn't find anywhere. The SSL Web Server certificate at least looks OK, with the Thawte Test Root CA installed,  no error or warning appear in mmc.exe view.

    But my WCF service still reports:  'System.IdentityModel.Tokens.SecurityTokenValidationException: The X.509 certificate CN=... chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. An internal certificate chaining error has occurred'.

    Switched back to SGC test certificate from thawte, re-do the same thing, this time the "not enough information " warning magically went away! And WCF services feedback a slightly different error:

    'The certificate that was used has a trust chain that cannot be verified, The revocation function was unable to check revocation because the revocation server was offline'.

    Checked the MS help, it seems I am very close now, very likely it's a test certificate issue. It might be fixed by some tricks on server side, for now, it's enough. Maybe we don't need it mode at all.

  4. PeerOrChainTrust

    Mixed mode, for tightly controlled enviroments. (Some very restrict Organization have their own root certificates?)

  5. Custom

    Client side creates X509CertificateValidator subclass assigned in app.config:

            <behavior name="myClientBehavior">
              <clientCredentials>
                <serviceCertificate>
                  <authentication certificateValidationMode="Custom"
                                  customCertificateValidatorType="Premotion.Services.MyX509Validator,client" />
                </serviceCertificate>
    
                <!--
                in B2B bindings, add 
    
                  <clientCertificate
                    findValue          = "MyClientCert"
                    storeLocation      = "LocalMachine"
                    storeName          = "My"
                    x509FindType       = "FindBySubjectName"
                  </clientCertificate>
    
                -->
              </clientCredentials>
            </behavior>
    
    

    same as the example shown in http://www.devatwork.nl/index.php/2007/05/31/wcf-username-authentication

A post about Fundamentals of WCF Security.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s