Email Password Remember me?  Lost your password?

• Download source and binary - 45 Kb

Introduction

Security has an important role in any distributed application and Windows Communication Foundation (known as WCF or Indigo), the new Microsoft communication framework, implements many security standards and has a wide range of features available.

One of the most important aspects of security is authentication. WCF can be configured to use many authentication methods:

• Anonymous caller
• User name and password
• Certificate
• Windows
• CardSpace

In this article I will show you how to configure WCF with certificates to authenticate service clients and server using an alternative approach.

If you want to exactly understand my implementation, continue reading the next section. If you simply want to understand how to configure WCF using certificates jump directly to the Quick start tutorial section.

Background concepts

The next sections assume that you are familiar with many WCF and security concepts. See the External resources section if you want to review some of these concepts or for more information.

The problem

The use of certificates for authentication is not new, but is still one of the most common way to authenticate a subject. WCF has a built-in support for certificates that conform to the Web Services Security (WS-Security) standards.

The problem with the default configurations and examples available is that all the certificates must be installed in the Certificate Store, which basically is a central location where Windows saves all the certificates (used also for other applications: Internet Explorer, ...).

Why this solution causes some problems? The easy answer is because it is not easy to correctly configure all the certificates. For more details:

• When you deploy your service to the server you must install in the Certificate Store all the certificates used (in different locations based on the use of the certificate).
  This operation must be executed using an installation program, a script file or a batch file. For this reason, it is difficult to deploy the application using an xcopy/ClickOnce installation.
• Each client must also install the certificate used to authenticate itself always in the Certificate Store. This is easy if you have a small number of clients but very difficult if you must manually configure each computer (in addition, for the client, you can't use an xcopy/ClickOnce installation).
• You must give to the running process (like ASP.NET) the permissions to read the certificate private key. This step usually requires changing the file system permission. This again requires a script file or an installation which is not always easy.
• If you are using a shared hosting probably you can't install certificates or change certificate permissions.
• As a developer I like to have each project isolated from the others. I want to be able to easy test different configurations or applications, I like to simply download the latest version from the code repository and run it, without any special configuration. Using the Certificate Store I must always remember to install or uninstall the certificates each time.

At the following MSDN page you can see an example of a configuration using certificates and a description of how to install certificates using the classic solution: MSDN: Message Security Certificate.

These are the reasons behind my decision to try a different approach that I will describe in the following sections.

The solution

My goal is to find an easy way to use certificates without using Certificate Store. WCF can be easily extended; in this article I will show you how to extend WCF to load the certificates from files.

I known that storing certificates on the file system is less secure, but I think that with some attention this can be a useful alternative. See the Disadvantages section for a discussion of the possible problems of my approach.

Consider that with my solution, I simply change how the certificates are loaded, all the advantages of using WCF (standards, proved code, ...) are still valid. Most important you must still use most of the settings required to use certificates. For a complete and working example, I suggest to look at the sample project in the zip file or follow the Quick start tutorial section to implement this solution on your own project.

To understand how this solution works, continue reading the next section.

Implementation details

Loading a certificate from a file is quite easy, you must simply use the System.Security.Cryptography.X509Certificates.X509Certificate2 class:

//Load the certificate from a file

X509Certificate2 certificate =
        new X509Certificate2(fullpath, password);    

The first parameter is the path of the certificate file, the second parameter is the password used to encrypt the private key (if present).

With X509Certificate2 class you can load 2 kinds of files:

• .cer file - Used to store a public key
• .pfx file - Used to store a public+private key (optional encrypted with a password)

You can obtain these files from a public certification authority or create your self-signed certificates using makecert.exe and pvk2pfx.exe, both available as Visual Studio Tools. Here an example on how to create a certificate:

makecert -r -pe -n "CN=CompanyXYZ Server" -b 01/01/2007 -e 01/01/2010
        -sky exchange Server.cer -sv Server.pvk
pvk2pfx.exe -pvk Server.pvk -spc Server.cer -pfx Server.pfx    

The first command (makecert) generates a public key (in this case Server.cer) and a private key (in this case Server.pvk). The second command (pvk2pfx) merges the 2 files on a single .pfx file (in this case Server.pfx).

When executing makecert and pvk2pfx, you can insert a password used to encrypt the private key.

Service authentication

This section describes how to configure the server with the certificate used to authenticate the service.

First you must add a reference to the DevAge.ServiceModel.dll. This assembly (included in the sample project with the full code) contains some classes used to load the certificate from a file that I will soon describe.

Then you must generate the service certificate and put it in a secure directory. For ASP.NET web site, I think that a good solution is to use the App_Data directory, which is automatically configured to not allow public access. I have generated in the App_Data directory 2 files: Server.cer and Server.pfx.

Usually you can specify the certificate for the service inside the system.serviceModel section of the .config file like this:

<behaviors>
  <serviceBehaviors>
    <behavior name="serviceCredentialBehavior">
      <serviceCredentials>
        <serviceCertificate findValue="Contoso.com"
                            storeLocation="LocalMachine"
                            storeName="My"
                            x509FindType="FindBySubjectName" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>    

This configuration basically tells WCF where to find the certificate inside the Certificate Store.

To load the certificate from file, unfortunately you can't simply change the configuration, but you must set the ServiceHost.Credentials.ServiceCertificate.Certificate property.

I have created a new configuration section where you can specify where to find the server certificate:

<devage.serviceModel>
<services>
  <add name="MathService"
        serverCertificate="App_Data\Server.pfx"
                />
</services>
</devage.serviceModel>    

Then I have created a new ServiceHost derived class, DevAge.ComponentModel.CertificateServiceHost, which automatically reads the new configuration section and sets the ServiceHost.Credentials.ServiceCertificate.Certificate property.

If you directly create the ServiceHost class you can simply change your code to create the DevAge.ComponentModel.CertificateServiceHost instead.
If you use ASP.NET (that automatically creates the ServiceHost class) you must configure the .svc file in this way:

<% @ServiceHost Language="C#" Debug="true"
        Service="MathService"
        CodeBehind="~/App_Code/MathService.cs"
        Factory="DevAge.ServiceModel.CertificateServiceHostFactory" %>    

Note the Factory property that uses a specific factory class to create my DevAge.ComponentModel.CertificateServiceHost.
This configuration replaces the standard serviceCertificate section.

NOTE: When you will create the proxy client with svcutil you will see an identity section inside the endpoint section:

<identity>
  <certificate encodedValue="...." />
</identity>

This section must be recreated each time you change the service certificate, because it contains the public identification of the certificate generated at design time. This value is used by the client to be sure to speak with the expected service.

Client authentication

This section describes how to use certificates to authenticate each client.

You must create a certificate for each client (or share the same certificate for more than one client). You can use the same command to generate self-signed certificates or obtain it from a certification authority.

In my example I have generated in the client directory 2 files: Client.cer and Client.pfx.

Normally each client can configure the application with the certificate using the configuration below:

<behaviors>
  <endpointBehaviors>
    <behavior name="ClientCredentialsBehavior">
      <clientCredentials>
        <clientCertificate findValue="Cohowinery.com"
             storeLocation="CurrentUser"
             storeName="My"
             x509FindType="FindBySubjectName" />
      </clientCredentials>
    </behavior>
  </endpointBehaviors>
</behaviors>    

This configuration always uses the Certificate Store to locate the right certificate to use and like in the previous example, there isn't a way to directly use a certificate file. So I have again created a new configuration section to specify the certificate file name:

<devage.serviceModel>
<endPoints>
  <add contract="Client.MathService.IMathService"
        clientCertificate="Client.pfx" />
</endPoints>
</devage.serviceModel>    

To manually set the certificate for the client you can set the ClientProxy.ClientCredentials.ClientCertificate.Certificate property.

Unfortunately in this case, there isn't a way to automatically set this property by reading the new section (or at least I cannot find a way...) so you must configure each proxy with code like this:

//Create the client proxy as usual

MathService.MathServiceClient service =
         new Client.MathService.MathServiceClient();

//Configure the client reading the devage.serviceModel configuration section

DevAge.ServiceModel.Proxy<MathService.IMathService>.Configure(service);    

The DevAge.ServiceModel.Proxy class reads the configuration section and sets the ClientProxy.ClientCredentials.ClientCertificate.Certificate property.

If the certificate used by the client is trusted by the server (usually must be added in the Trusted people of the Certificate Store) your configuration is complete. If otherwise the certificate is self-signed or anyway is not trusted by the server you must configure the server to accept the certificate.

To solve this issue, I have implemented a custom X509CertificateValidator class, DevAge.ServiceModel.CustomCertificateValidator, which can be configured for each service. You must extend the devage.serviceModel section of the .config file of the service (on the server) like this:

<devage.serviceModel>
<services>
  <add name="MathService"
        serverCertificate="App_Data\Server.pfx"
        clientCertificates="App_Data\Client1.cer,App_Data\Client2.cer"
                />
</services>
</devage.serviceModel>    

Note the new clientCertificates property which contains a list of client certificates to consider trusted.

You must copy inside the App_Data server directory all the client public key files (in this case Client1.cer and Client2.cer files).

The CertificateServiceHost class automatically reads this new section and sets the X509CertificateValidator using code like this:

X509ClientCertificateAuthentication authentication =
            serviceHost.Credentials.ClientCertificate.Authentication;

authentication.CertificateValidationMode =
        System.ServiceModel.Security.X509CertificateValidationMode.Custom;

authentication.CustomCertificateValidator =
    new CustomCertificateValidator(clientCertificates);    

If the certificate file has a password, you can specify it within the file name using this format: filename|password. For example you can specify the serverCertificate attribute of the web.config with this value: App_Data\Server.pfx|yourpassword.
Remember also that you can specify 2 different password for the *.pvk and for the *.pfx files, the password to use is the password specified for the *.pfx file. See the makecert and pvk2pfx documentation for more details on how to set passwords.

Disadvantages

Storing the certificates on files is easier but is less secure because a malicious user can steal the private key. The public key can be shared without problems but if someone steals the private key your security is compromised. With the private key a malicious user can decrypt the messages or impersonate your service or a client.

I think anyway that usually if someone can access your file system you probably have many other security problems. Consider also that if someone has access to your file system, he or she can probably (depends on the type of the attack) also access the Certificate Store.

My suggestion is to correctly evaluate your application and your security requirements. In many cases, I think that saving certificate on a file is quite secure and can be useful.

Finally consider that you can use a mixed configuration, for example reading the server certificate inside the Certificate Store and the client certificates on file system.

Quick start tutorial

Here a simple tutorial to use certificates with a service hosted on IIS/ASP.NET and a console client application. I will create a simple Math service with a single Sum method.

Creating the service

Create a new web site project; add a reference to the DevAge.ServiceModel.dll assembly (that you can find in the sample project).

Add these files:

• App_Code/MathService.cs

  using System;
  using System.ServiceModel;
  using System.Runtime.Serialization;
  
  [ServiceContract()]
  public interface IMathService
  {
      [OperationContract]
      double Sum(double a, double b);
  }
  
  public class MathService : IMathService
  {
      public double Sum(double a, double b)
      {
          return a + b;
      }
  }    

• MathService.svc

  <% @ServiceHost Language="C#" Debug="true"
          Service="MathService"
          CodeBehind="~/App_Code/MathService.cs"
          Factory="DevAge.ServiceModel.CertificateServiceHostFactory" %>    

• Web.config

  <?xml version="1.0"?>
  <configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
    <configSections>
      <!-- Add devage.serviceModel section handler -->
      <section name="devage.serviceModel"
          type="DevAge.ServiceModel.Configuration.Section, 
                      DevAge.ServiceModel" />
    </configSections>
  
    <system.serviceModel>
      <services>
        <service name="MathService" behaviorConfiguration="behavior1">
          <endpoint contract="IMathService"
              binding="wsHttpBinding" bindingConfiguration="binding1"/>
        </service>
      </services>
  
      <behaviors>
        <serviceBehaviors>
          <behavior name="behavior1">
            <serviceMetadata httpGetEnabled="true"/>
            <serviceDebug includeExceptionDetailInFaults="true"/>
          </behavior>
  
        </serviceBehaviors>
      </behaviors>
      <bindings>
        <wsHttpBinding>
          <binding name="binding1">
            <security mode="Message">
  
              <message clientCredentialType="Certificate" />
            </security>
          </binding>
        </wsHttpBinding>
      </bindings>
    </system.serviceModel>
  
    <!-- Specific DevAge.ServiceModel configuration used
          to set the client and server certificate -->
    <devage.serviceModel>
      <!-- List of service type each with the relative server
          certificate and client certificate list -->
      <services>
        <add name="MathService"
              serverCertificate="App_Data\Server.pfx"
              clientCertificates=""
                      />
      </services>
  
    </devage.serviceModel>
  </configuration>    

Now you must obtain a server certificate, you can buy it from a certification authority or create a self-signed certificate with the following procedure:
Open a Visual Studio Command Prompt, go to the App_Data directory and execute these commands (don't insert the password when asked):

makecert -r -pe -n "CN=CompanyXYZ Server" -b 01/01/2007 -e 01/01/2010
        -sky exchange Server.cer -sv Server.pvk
pvk2pfx.exe -pvk Server.pvk -spc Server.cer -pfx Server.pfx    

Run the project on Visual Studio to start the ASP.NET Development Server and try to navigate to the MathService.svc page.

Creating the client

Create a new Console Application project using "Client" as the project name; add a reference to the DevAge.ServiceModel.dll assembly (that you can find in the sample project). Using Visual Studio you must right click on the project and select "Add Service Reference". Insert the URL of your service (probably something like http://localhost:1281/Server/MathService.svc) and the name MathService.

Create a new Program.cs file to test your service like this:

using System;
using System.Collections.Generic;
using System.Text;

namespace Client
{
class Program
{
    static void Main(string[] args)
    {
        MathService.MathServiceClient service =
                new MathService.MathServiceClient();

        //Configure the client reading the devage.serviceModel 

        //configuration section

        DevAge.ServiceModel.Proxy<MathService.IMathService>.Configure(service);

        try
        {
            double val = service.Sum(10, 20);

            Console.WriteLine("OK");
        }
        catch (Exception ex)
        {
            service.Abort();

            Console.WriteLine(ex.ToString());
        }

        Console.WriteLine("Press Enter key to exit...");
        Console.ReadLine();
    }
}
}    

Open the app.config file, save in a temp file the encodedValue attribute in the certificate tag. Replace the app.config file with the configuration below, but remember to restore the previous encodedValue attribute and check the address attribute to point to the right service URL:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <configSections>

    <!-- Add devage.serviceModel section handler -->
    <section name="devage.serviceModel"
        type="DevAge.ServiceModel.Configuration.Section, DevAge.ServiceModel" />
  </configSections>
  <system.serviceModel>
    <bindings>
      <wsHttpBinding>

        <binding name="binding1" >
          <security mode="Message">
            <!-- Set the client authentication mode -->
            <message clientCredentialType="Certificate" />
          </security>
        </binding>

      </wsHttpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="behavior1">
          <clientCredentials>

            <serviceCertificate>
              <authentication certificateValidationMode="None" />
            </serviceCertificate>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>

    </behaviors>
    <client>
      <endpoint address="http://localhost:1281/Server/MathService.svc"
          binding="wsHttpBinding" bindingConfiguration="binding1"
          contract="Client.MathService.IMathService"
          behaviorConfiguration="behavior1"
           name="endpoint1" >
        <identity>
          <!--This is the value used to check the server certificate identity,
            this value is generated by svcutil -->
          <certificate encodedValue="TODO Here use your specific encodedValue" />
        </identity>
      </endpoint>
    </client>
  </system.serviceModel>
  <!-- Specific DevAge.ServiceModel configuration -->
  <devage.serviceModel>

    <!-- List of endPoints each with the relative client certificate
         to use for authentication. -->
    <endPoints>
      <add contract="Client.MathService.IMathService"
            clientCertificate="..\..\Client.pfx" />
    </endPoints>
  </devage.serviceModel>
</configuration>    

Now we must generate the client certificate. Again this certificate can be obtained from a certification authority or created with the procedure below:
Open a Visual Studio Command Prompt, go to the client project directory and execute these commands (don't insert the password when asked):

makecert -r -pe -n "CN=CompanyXYZ Client" -b 01/01/2007 -e 01/01/2010
        -sky exchange Client.cer -sv Client.pvk
pvk2pfx.exe -pvk Client.pvk -spc Client.cer -pfx Client.pfx    

Finally copy the Client.cer file in the server App_Data directory and modify the web.config server file adding the client certificate like this:

<!-- Specific DevAge.ServiceModel configuration used to set
    the client and server certificate -->
<devage.serviceModel>

    <!-- List of service type each with the relative server
          certificate and client certificate list -->
    <services>
      <add name="MathService"
            serverCertificate="App_Data\Server.pfx"
            clientCertificates="App_Data\Client.cer"
                    />
    </services>
</devage.serviceModel>    

Note the clientCertificates attribute that now contains the Client.cer file.

Now you can test your client application.

Sample project

In the sample project, I have created a full working example composed of:

• Server - a service hosted by a web site project
• Client - the service client implemented as a console application
• DevAge.ServiceModel - the library that contains the new implementation used to load the certificates from a file

You can simply open the solution with Visual Studio 2005 and run the Client project to test the code.

Conclusion

I think that this article show the advantages and disadvantages of loading the certificates from files without using the Certificate Store. Security is important and I know that this solution is not perfect, but can be a useful alternative. Consider anyway that it is always easy to change the configuration files to use the classic approach.

Write to me if you find errors (on code or documentation) or if you have problems, questions or suggestions. I will appreciate any feedback.

External resources

• MSDN WCF Home Page
• An MSDN article with a good overview of the certificates used for authentication:
  Message Security with Mutual Certificates
• A good introduction and overview of WCF:
  Code Magazine - Fundamentals of WCF Security by Michele Leroux Bustamante
• A site with some good WCF resources:
  http://www.netfx3.com/
• Some important definitions and concepts from Wikipedia:
  • Public key certificate
  • Public key infrastructure
  • Certificate authority

History

• 30 Apr 2007: First release

You must Sign In to use this message board.

Per page 102550

FirstPrevNext

The specified network password is not correct. tony.debenport 5:35 26 Oct '09   Thanks for the good article. I've got your example to work on my local machine with no issues but am seeing the following error message when I tried to deploy on the internet (Discountasp.net) Any ideas on how to resolve this issue? Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.Security.Cryptography.CryptographicException: The specified network password is not correct. Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. Stack Trace: [CryptographicException: The specified network password is not correct. ] System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr) +33 System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromFile(String fileName, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle& pCertCtx) +0 System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromFile(String fileName, Object password, X509KeyStorageFlags keyStorageFlags) +237 System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(String fileName, String password) +131 DevAge.ServiceModel.CertificateHelper.LoadFromFile(String file) +396 DevAge.ServiceModel.Configuration.ServiceElement.GetServerCertificate() +49 DevAge.ServiceModel.CertificateServiceHost.ApplyConfiguration() +231 System.ServiceModel.ServiceHostBase.InitializeDescription(UriSchemeKeyedCollection baseAddresses) +190 System.ServiceModel.ServiceHost.InitializeDescription(Type serviceType, UriSchemeKeyedCollection baseAddresses) +32 System.ServiceModel.ServiceHost..ctor(Type serviceType, Uri[] baseAddresses) +139 DevAge.ServiceModel.CertificateServiceHost..ctor(Type serviceType, Uri[] baseAddresses) +39 DevAge.ServiceModel.CertificateServiceHostFactory.CreateServiceHost(Type serviceType, Uri[] baseAddresses) +59 System.ServiceModel.Activation.ServiceHostFactory.CreateServiceHost(String constructorString, Uri[] baseAddresses) +331 System.ServiceModel.HostingManager.CreateService(String normalizedVirtualPath) +11659932 System.ServiceModel.HostingManager.ActivateService(String normalizedVirtualPath) +42 System.ServiceModel.HostingManager.EnsureServiceAvailable(String normalizedVirtualPath) +479 [ServiceActivationException: The service '/BSTComWCF/BSTCom.svc' cannot be activated due to an exception during compilation. The exception message is: The specified network password is not correct. .] System.ServiceModel.AsyncResult.End(IAsyncResult result) +11531006 System.ServiceModel.Activation.HostedHttpRequestAsyncResult.End(IAsyncResult result) +194 System.ServiceModel.Activation.HostedHttpRequestAsyncResult.ExecuteSynchronous(HttpApplication context, Boolean flowContext) +176 System.ServiceModel.Activation.HttpModule.ProcessRequest(Object sender, EventArgs e) +278 System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +68 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75 Sign In·View Thread·PermaLink Re: The specified network password is not correct. Nuno M C Rodrigues 11:05 27 Oct '09   I had the same error.     Localy on a XP machine, perfect.     On the Dev server (WinSrv2003), perfect.     On Production server, "The specified network password is not correct".     On "DevAge.ServiceModel.CertificateHelper" class at the instantiation of the X509Certificate2 pass the flag X509KeyStorageFlags.Exportable, like: new X509Certificate2(fullPath, password, X509KeyStorageFlags.Exportable) Hope it helps   Sign In·View Thread·PermaLink 5.00/5 Re: The specified network password is not correct. tony.debenport 7:13 28 Oct '09   Nuno, Thanks! You pointed me in the right direction. When I set the storageflag to Exportable it didn't work, but according to my isp provider the keys are stored in the Machine Key store. The code below worked. new X509Certificate2(fullPath, password, X509KeyStorageFlags.MachineKeySet); Sign In·View Thread·PermaLink Great Example, small change: Load certificate from refered assembly NunoPulga 4:25 22 Oct '09   Hello, in my particular case I needed to retrieve the certificate inside an assembly. so a made some simple changes in your "CertificateHelper" class to add that extra funcionality without ruining the file system method. Just insert a valid URI address in the "clientCertificate" property. <devage.serviceModel> <endPoints> <add contract="IDataContract" clientCertificate="pack://AssemblyName:,,,/Certificate.pfx" /> </endPoints> </devage.serviceModel> Anyone interested on that "upgrade" please, reply or pvt me and I gladly send that class to you. Author: Thanks again for your article, was a true life and time saver.    modified on Monday, October 26, 2009 1:58 PM Sign In·View Thread·PermaLink Little bug when putting website online: file not found Manuvdp 3:20 5 Oct '09   Hi, great solution. When I put the website online I receive a file not found error in CertificateHelper.cs change: var cert = new X509Certificate2(fullPath, password); to var cert = new X509Certificate2(fullPath, password, X509KeyStorageFlags.MachineKeySet); Otherwise you receive an error : could not read file... Secondo : check namespaces of you service + configuration files. Search a long time on that Sign In·View Thread·PermaLink Help - certificate problems.... jonna toon 7:04 27 May '09   Congratulations on a great post - this is exactly what I was looking for. And it was refreshingly straight forward setting up the demo project. I do have an issue though.. when integrating this capability into my solution I get the following certificate authentication exception when attempting to invoke service operations from a client: System.IdentityModel.Tokens.SecurityTokenValidationException: The X.509 certificate CN=TestServiceCertificate chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. As it happens, I tried regenerating the server/client certificates in your test solution (that I downloaded and managed to get working easy enough) and get the same problem. Any ideas? I've done very little around security as there has never previously been the need, but I need to secure the service I've currently implementing so have done some reading... Based around what I've read of Mutual SSL, my understanding is that the client certificate ought to be signed by a root certificate trusted by the server/host. I thought it was strange that in your example the client and server certificates were generated in isolation of each other - I would have expected the client cert to have been derived/created based upon the server cert? - perhaps this is why I'm encountering the problem. Can anyone assist? Advice please! Thanks. Sign In·View Thread·PermaLink 5.00/5 Re: Help - certificate problems.... NunoPulga 9:24 20 Oct '09   I came across the exact same problem... Sign In·View Thread·PermaLink Re: Help - certificate problems.... NunoPulga 10:19 20 Oct '09   I found the problem, be sure that "endpointBehavior" is implemented by your "endpoint". <behaviors> <endpointBehaviors> <behavior name="behavior1"> <clientCredentials> <serviceCertificate> <!-- Set certificateValidationMode to None to don't check if the server certificate is trusted, so you can use self signed certificate. WARNING: Remember to set this property to ChainTrust or PeerOrChainTrust when using a certificate generated from a trusted authority --> <authentication certificateValidationMode="None" /> </serviceCertificate> </clientCredentials> </behavior> </endpointBehaviors> </behaviors> <endpoint address="http://www.example.com" behaviorConfiguration="behavior1" /> PS: my case was to dynamically load endpoints from other assembly. that made easy to leave behind this behavior. Hope it helps. Sign In·View Thread·PermaLink Please Help Me with certification authority !!!! freger 6:23 11 Feb '09   Hallo I ordered a certificate from CA (Verisign). Now I have certificates, but how can I expect from these certificates. Pfx file? Please Help Me! ThankS!!!!!!!! Sign In·View Thread·PermaLink Re: Please Help Me with certification authority !!!! Davide Icardi 13:26 21 Feb '09   Usually you can receive the file in .cer+.pvk format or the .pfx format. But with some tools you can convert from one format to another if needed. Another solution is to import it in widnows and then export it in another format. Davide Sign In·View Thread·PermaLink netTcpBinding divider 7:19 22 Jan '09   Hi, thanks for your great article ! i really helped me understand many things about WCF ! i am trying to implement a WCF service as Application not as a WebService. been playing a few days with your method but it seems that either i am doing something really wrong (probably ) or your method cant be applied in my case ! i dont wonna post configs for the moment but if your method can be applied in my case i will post them in case i do something wrong again .. Thanks for your article and your hard work putted in to it George. ps. My english are bad, i know ! Sign In·View Thread·PermaLink Getting Error of Authentication on running client Vikas Gandhi 21:54 13 Nov '08   System.ServiceModel.Security.SecurityNegotiationException: The caller was not au thenticated by the service. ---> System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed. at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target) at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingM essageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState) Sign In·View Thread·PermaLink 1.50/5 Good Article - Update Writing? mklinker 11:36 7 Nov '08   I first want to thank you fro the great article! It's well thought out, documented, and from the looks of it it works well for people. Thanks for taking the time to contribute. I'm currently working in a hosted situation where I cannot install a cert into the server store, so I'm evaluating this solution. What I'd like to suggest is that in future articles to provide better reasoning and explanation in all parts. There's a few sections here that read simply, copy this and paste that here and replace this with that etc. In my current situation, I don't want to simply overwrite everything in my project, but I don't neccessarily know the important parts of that copy/paste. Aren't copy/paste developers the worst? Again, it's a great read and I'm sure it will help me out tremendously, thanks much! Sign In·View Thread·PermaLink Re: Good Article - Update Writing? Davide Icardi 22:59 7 Nov '08   Yes, you are right. I must admit that the article doesn't explain all the code ... I will try for the future to write better and with more details! Thanks for the suggestion Davide Sign In·View Thread·PermaLink Issue when AspNetCompatibillitymMode enabled Rhettc 5:14 19 Sep '08   This functionality is fantastic and thanyou for sharing it. I only have one issue and that is when I enable AspNetCompatibillityMode. I have to do that so I can run my WCF service in IIS on Win XP as an impersonated user (a user i have created on the local machine). I receive an error that 'The user cannot be authenticated by the service'. when I remove the AspNetCompatibillitymMode the service runs as MACHINENAME\ASPNET and it works fine. My local user is set as an administrator (for dev purpose only) so I cannot see why the difference in the user credentials would make a difference. I have debugged through the code and the certificates are read and assigned in the same manner with both scenarios, the difference is when the service is called it throws the exception. My main aim is to use windows auth for connection to a local database so impersonation of an account I create is more ideal then assigning rights to the ASPNET user for database access. Any thoughts? Regards, Rhett Sign In·View Thread·PermaLink Re: Issue when AspNetCompatibillitymMode enabled Davide Icardi 23:43 2 Oct '08   No I'm sorry I don't have any idea. Seems to be a problem with that user but I really don't known what can be the problem. I'm sorry Davide Sign In·View Thread·PermaLink Re: Issue when AspNetCompatibillitymMode enabled Rhettc 0:35 8 Oct '08   No worries, thanks for your time. I've ended up just giving the required access to ASPNET for the time being. Thanks, Rhett Sign In·View Thread·PermaLink singletonInstance instead of serviceType tsemer 6:29 15 Sep '08   Hi, First of all, superb read and great help, I've been searching all over for this supposedly simple solution for reading certificates from files. However, as sad as may be, I cannot seem to use your code for the following 2 reasons: 1. The architecture I'm using is calling for the constructor of ServiceHost() that accepts a singleton instance (of type Object) rather than a service type (of type Type). I wish you would extend your library to support that constructor as well. 2. I believe it might work anyway, with loss of a few extras, but my service host is of type WebServiceHost, which is the RESTful offspring of ServiceHost. Thus, using your library is not fully supporting REST (which in my humble opinion will succeed SOAP sooner or later). Is there any possiblity for you to keep on going with this and inherit WebServiceHost as well? All in all, great, detailed article, thanks again. Sorry I couldn't use your library to tell you how great it works as well . Ohad Sign In·View Thread·PermaLink Re: singletonInstance instead of serviceType Davide Icardi 12:24 24 Oct '08   Hi, Unfortunately in these days I'm busy with another project. Probably is not too much difficult to implement these features but require some time. If I can maybe in the future I will try to work on this, but for now I haven't enough time. I'm sorry ... Davide Sign In·View Thread·PermaLink Multiple certficate.... Himanshu Shu 21:10 30 Jul '08   Even I have one more query. The web.config of service have the section called And it have the "serverCertificate" and "clientCertificate" attributes with it which specify the locations of the certificates stored on the machine thorough which we need to validate the authentication of the client. The code looks like: <!-- List of service type each with the relative server certificate and client certificate list --> serverCertificate="App_Data\Server.pfx" clientCertificates="App_Data\Client.cer" /> I want to give the access of my service to many clients. I have issued certificates for them. They must be of different names(which uniquely identify the authenticity of the client). I think in this case, this single line will not help. We need to search the certificate from some local drive and then authenticate it using that certificate. Please tell me the way I should implement this. Thanks in advance for the same... Sign In·View Thread·PermaLink 2.00/5 Re: Multiple certficate.... Davide Icardi 3:26 6 Oct '08   You can specify a list of certificates for the client (separated by a comma if I remember well). I think that in your case should work. Davide Sign In·View Thread·PermaLink Query Regarding Client Himanshu Shu 1:27 28 Jul '08   Hi, First of all I want to congratulate you for the excellent presentation of the topic. Also I want to say thanks to you for the same. I have a query. Actually I am creating a service whose method is to be exposed through net. The service should have the same features as yours. The problem with me is at the client side. I want my client to be independent of platform. So, in this case, if the client is using other languages than .NET, the client must not be having the web.config/app.config Also, I can't ask my general client to go to his/her web.config/app.config and modify the config sections and endpoints. I can only ask them to add or update the service reference which in turn can do all the settings part by itself. Kindly help me finding the solution. Any help is highly appreciated. Sign In·View Thread·PermaLink Re: Query Regarding Client Himanshu Shu 21:55 29 Jul '08   Any clue on that??? Please help me. Sign In·View Thread·PermaLink Re: Query Regarding Client Davide Icardi 3:24 6 Oct '08   Sorry for the late (very late) response ... Anyway I think that to be client independent is not easy but it is possible. All the communication are based on soap and xml and so you can simulate it on any platform. But I don't known if in this case this is the best solution, can be quite difficult to rewrite all the security and communication layer of WCF. Maybe I suggest to create a specific solution for your specific case. Davide Sign In·View Thread·PermaLink What I have been searching for a long time now. Amour Rashid 20:01 19 May '08   Thank you very much and congratulations. I really came accross this article while in search for a better way of dealing with certificates especially on the client side. To be precise I am using Channel factory rather than Proxy. Does the solution work for my cenario. Secondly, Can I use this self signed cenrtificate for production or must I buy from third party. And Lastly does this replace the System.ServiceModel section in the configuration file. Thanks amourrashid@yahoo.com Amour Rashid Hamad P.O.Box 9294 Directorate Of Information Services (TTCL) Dar Es Salaam Tanzania Sign In·View Thread·PermaLink

Last Visit: 3:33 21 Nov '09     Last Update: 3:33 21 Nov '09 12 Next »