本篇介绍security mode 为Message且clientCredentialType为"Certificate"的binding配置。

　　在服务端app.config文件中，在endpoint 中指定了basicHttpBinding并且指向一个名为Binding1的binding configuration ，如下的示：

　　<service name="Microsoft.Samples.MessageSecurity.CalculatorService"behaviorConfiguration="CalculatorServiceBehavior"> 　　<host> 　　<baseAddresses> 　　<add baseAddress="http://localhost:8000/ServiceModelSamples/service"/> 　　</baseAddresses> 　　</host> 　　<!-- this endpoint is exposed at the base address provided by host: http://localhost:8000/ServiceModelSamples/service --> 　　<endpoint address="" binding="basicHttpBinding"bindingConfiguration="Binding1" contract="Microsoft.Samples.MessageSecurity.ICalculator"/> 　　<!-- the mex endpoint is exposed at http://localhost:8000/ServiceModelSamples/service/mex --> 　　<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/> 　　</service>

　　在 binding configuration 中则可以指定我们需要的配置：security mode 为Message　且clientCredentialType为"Certificate"。如下所示：

　　<basicHttpBinding> 　　<!-- 　　This configuration defines the SecurityMode as Message and 　　the clientCredentialType as Certificate. 　　--> 　　<binding name="Binding1"> 　　<security mode="Message"> 　　<message clientCredentialType="Certificate"/> 　　</security> 　　</binding> 　　</basicHttpBinding>

　　服务端用来让客户端验证自己的证书配置在behaviors节点的serviceCredentials元素中（同样，客户端用来　让服务端认证证书配置客户端配置文件的behaviors节点的clientCertificate元素中）。如下所示：

　    <behaviors> 　　<serviceBehaviors> 　　<behavior name="CalculatorServiceBehavior"> 　　<serviceMetadatahttpGetEnabled="True"/> 　　<serviceDebugincludeExceptionDetailInFaults="False"/> 　　<!-- 　　The serviceCredentials behavior allows one to define a service certificate. 　　A service certificate is used by a client to authenticate the service and provide message protection. 　　This configuration references the "localhost" certificate installed during the setup instructions. 　　--> 　　<serviceCredentials> 　　<serviceCertificatefindValue="localhost"storeLocation="LocalMachine"storeName="My" x509FindType="FindBySubjectName"/> 　　<clientCertificate> 　　<!-- 　　Setting the certificateValidationMode to PeerOrChainTrust means that if the certificate 　　is in the user's Trusted People store, then it will be trusted without performing a 　　validation of the certificate's issuer chain. This setting is used here for convenience so that the 　　sample can be run without having to have certificates issued by a certificate authority (CA). 　　This setting is less secure than the default, ChainTrust. The security implications of this 　　setting should be carefully considered before using PeerOrChainTrust in production code. 　　--> 　　<authentication certificateValidationMode="PeerOrChainTrust"/> 　　</clientCertificate> 　　</serviceCredentials> 　　</behavior> 　　</serviceBehaviors> 　　</behaviors>

　　其中<authentication certificateValidationMode="PeerOrChainTrust" />应只在开发环境中使用。在客户端的配置必须和服务器端保持一样。如下所示： 　

   　&lt;client&gt; 　　&lt;!-- Use a behavior to configure the client certificate to present to the service. --&gt; 　　&lt;endpoint name="" address="http://localhost:8000/servicemodelsamples/service" binding="basicHttpBinding"bindingConfiguration="Binding1"behaviorConfiguration="ClientCertificateBehavior" contract="Microsoft.Samples.MessageSecurity.ICalculator"/&gt; 　　&lt;/client&gt; 　　&lt;basicHttpBinding&gt; 　　&lt;!-- 　　This configuration defines the SecurityMode as Message and 　　the clientCredentialType as Certificate. 　　--&gt; 　　&lt;binding name="Binding1"&gt; 　　&lt;security mode="Message"&gt; 　　&lt;message clientCredentialType="Certificate"/&gt; 　　&lt;/security&gt; 　　&lt;/binding&gt; 　　&lt;/basicHttpBinding&gt; 　　&lt;behaviors&gt; 　　&lt;endpointBehaviors&gt; 　　&lt;behavior name="ClientCertificateBehavior"&gt; 　　&lt;!-- 　　The clientCredentials behavior allows one to define a certificate to present to a service. 　　A certificate is used by a service to authenticate the client and provides message protection. 　　This configuration references the "client.com" certificate installed during the setup instructions. 　　--&gt; 　　&lt;clientCredentials&gt; 　　&lt;clientCertificatefindValue="client.com"storeLocation="CurrentUser"storeName="My" x509FindType="FindBySubjectName"/&gt; 　　&lt;serviceCertificate&gt; 　　&lt;!-- 　　Setting the certificateValidationMode to PeerOrChainTrust means that if the certificate 　　is in the user's Trusted People store, then it will be trusted without performing a 　　validation of the certificate's issuer chain. This setting is used here for convenience so that the 　　sample can be run without having to have certificates issued by a certificate authority (CA). 　　This setting is less secure than the default, ChainTrust. The security implications of this 　　setting should be carefully considered before using PeerOrChainTrust in production code. 　　--&gt; 　　&lt;authentication certificateValidationMode="PeerOrChainTrust"/&gt; 　　&lt;defaultCertificatefindValue="localhost"storeLocation="CurrentUser"storeName="TrustedPeople" x509FindType="FindBySubjectName"/&gt; 　　&lt;/serviceCertificate&gt; 　　&lt;/clientCredentials&gt; 　　&lt;/behavior&gt; 　　&lt;/endpointBehaviors&gt; 　　&lt;/behaviors&gt;

    　案例运行步骤（仅服务端和客户端在同一机器上运行）：

　　1、 通过SDK cmd工具运行setup.bat，这将安装案例所需的所有证书。

　　2、从service\bin运行服务端应用程序。

　　3、从client\bin运行客户端应用程序，客户端的活动将显示在控制台中。

　　4、通过SDK cmd工具运行 Cleanup.bat ，这会移除案例所需的所有证书。

本站技术原创栏目文章均为中睿原创或编译，转载请注明：文章来自中睿，本站保留追究责任的权利。