我正在尝试创建一个安全的网络服务。

这里是合约和服务实现

[ServiceContract()]
public interface ICalculatorService
{
    [OperationContract()]
    int Add(int x, int y);
}

[ServiceBehavior(IncludeExceptionDetailInFaults=true)]
public class CalculatorService : ICalculatorService
{
    public int Add(int x, int y)
    {
        return x + y;
    }
}

我这里有服务代码

var b = new WSHttpBinding(SecurityMode.Transport);
b.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
b.Security.Message.ClientCredentialType = MessageCredentialType.None;

Type contractType = typeof(ICalculatorService);
Type implementedContract = typeof(CalculatorService);
Uri baseAddress = new Uri("https://localhost:8006/CalculatorService");
ServiceHost sh = new ServiceHost(implementedContract);

sh.AddServiceEndpoint(contractType, b, baseAddress);

//ServiceMetadataBehavior sm = new ServiceMetadataBehavior();
//sm.HttpsGetEnabled = true;
//sm.HttpsGetUrl = new Uri("https://localhost:8006/CalculatorServiceMex");
//sh.Description.Behaviors.Add(sm);

sh.Credentials.Peer.PeerAuthentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust;
        sh.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.TrustedPeople, X509FindType.FindBySubjectName, "localhost");

sh.Open();
Console.WriteLine("Service is Listening");
Console.ReadLine();
sh.Close();

这是客户端代码

var b = new WSHttpBinding(SecurityMode.Transport);
b.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
b.Security.Message.ClientCredentialType = MessageCredentialType.None;

var factory = new ChannelFactory<ICalculatorService>(b);
factory.Credentials.Peer.PeerAuthentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust;
        factory.Credentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.TrustedPeople, X509FindType.FindBySubjectName, "localhost");

var client = factory.CreateChannel(new EndpointAddress(new Uri("https://localhost:8006/CalculatorService")));

ServicePointManager.ServerCertificateValidationCallback =
   ((sender, certificate, chain, sslPolicyErrors) =>
            {
                return true;
            });

ICommunicationObject comObject = client as ICommunicationObject;
int result = -1;
try
{
  comObject.Open();
  result = client.Add(10, 2);
}
catch (Exception ex)
{

}
Console.WriteLine(string.Format("Service say 10 + 2 = {0}", -1));
Console.ReadLine();

服务运行良好，当进行 ServicePointManager.ServerCertificateValidationCallback 检查时，没有策略错误，并构建了正确的证书链。

我的 CA 位于受信任的根目录中，服务器/客户端证书位于 TrustedPeople 存储中。此外，如果我从浏览器导航到该站点，我会看到返回的页面。没有错误

我已将 IIS 更新为我认为需要的，并在 IIS 中绑定(bind)了证书

并通过下面的命令行。

我已将 SSL 设置为接受证书

并启用匿名身份验证。

有谁知道我没有正确完成哪些步骤或发现任何不妥之处？我不断收到相同的错误“HTTP 请求被禁止使用客户端身份验证方案‘匿名’。”

最佳答案

另一个原因是您访问的服务器上的证书本身。确保您已导入私钥。在 MMC 中，这将显示为“友好名称”。这花了我几天时间才弄明白。一旦我导入了私钥，匿名错误就消失了，一切都很好!

关于c# - 客户端身份验证方案 'Anonymous' 禁止 HTTP 请求。远程服务器返回错误 : (403) Forbidden，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/26169136/