WCF Configure Mutual Authentication with Transport Security and Client Side Certificates

i have wcf service hosted in secured mode on https. when use transport without client-side certificate, https call successful; however, need example of server side , client side web.config make secured call certificates on both sides

 <system.servicemodel>
    <bindings>
      <wshttpbinding>
        <binding name="wshttpendpointbinding">
          <security mode="transport">
            <transport clientcredentialtype="none" />
          </security>
        </binding>
      </wshttpbinding>

here server web.config not work

 <system.servicemodel>
    <bindings>
       <wshttpbinding>
          <binding name="wshttpendpointbinding">
             <security mode="transport">
                <transport clientcredentialtype="certificate" />
                <message clientcredentialtype="none" />
             </security>
          </binding>
       </wshttpbinding>
    </bindings>
    <client/>
    <services>
       <service behaviorconfiguration="tokenapplicationservicebehavior"
          name="tokenapplicationservice.tokenapplicationservice">
          <endpoint address="" behaviorconfiguration="tokenapplicationendpointservicebehavior"
             binding="wshttpbinding" bindingconfiguration="wshttpendpointbinding"
             name="wshttpendpoint" contract="tokenapplicationservice.itokenapplicationservice" />
          <endpoint address="mex" binding="mexhttpsbinding" bindingconfiguration="wshttpendpointbinding"  behaviorconfiguration="tokenapplicationendpointservicebehavior"
             contract="imetadataexchange" />
       </service>
    </services>
  <behaviors>
      <servicebehaviors>
    <behavior name="tokenapplicationservicebehavior">
     <!-- avoid disclosing metadata information, set value below false , remove metadata endpoint above before deployment -->
          <servicemetadata httpgetenabled="false" httpsgetenabled="true"/>
          <!--<servicemetadata httpgetenabled="true" />-->
     <!-- receive exception details in faults debugging purposes, set value below true.  set false before deployment avoid disclosing exception information -->
     <servicedebug includeexceptiondetailinfaults="true" />

          <servicecredentials>
            <clientcertificate>
              <authentication certificatevalidationmode="peerorchaintrust"/>
              <authentication trustedstorelocation="localmachine" revocationmode="online"/>
            </clientcertificate>
            <servicecertificate findvalue="tokencertificate"
                                storelocation="localmachine"
                                storename="my"
                                x509findtype="findbysubjectname" />
          </servicecredentials>
        </behavior>
   </servicebehaviors>

      <endpointbehaviors>
        <behavior name="tokenapplicationendpointservicebehavior">
        </behavior>
      </endpointbehaviors>
    </behaviors>
    <diagnostics>
      <messagelogging logmalformedmessages="false" logmessagesatservicelevel="true" logmessagesattransportlevel="true" />
    </diagnostics>
  </system.servicemodel>

-------------------------------------------------------

here client web.config

<system.servicemodel>
    <client>
      <endpoint behaviorconfiguration="clientcertificatebehavior"  binding="wshttpbinding"
        bindingconfiguration="wshttpbinding_itokenapplicationservice" contract="imetadataexchange" name="https" />
      <endpoint address="https://token1.mycompany.com/tokenapplicationservice.svc"
  binding="wshttpbinding" bindingconfiguration="wshttpbinding_itokenapplicationservice"
  contract="tokenapplicationservice.itokenapplicationservice" name="wshttpbinding_itokenapplicationservice">
      </endpoint>
    </client>   
    <bindings>
       <wshttpbinding>
          <binding name="wshttpbinding_itokenapplicationservice" closetimeout="00:01:00"
             opentimeout="00:01:00" receivetimeout="00:10:00" sendtimeout="00:01:00"
             bypassproxyonlocal="false" transactionflow="false" hostnamecomparisonmode="strongwildcard"
             maxbufferpoolsize="524288" maxreceivedmessagesize="65536" messageencoding="text"
             textencoding="utf-8" usedefaultwebproxy="true" allowcookies="false">
             <readerquotas maxdepth="32" maxstringcontentlength="8192" maxarraylength="16384"
                maxbytesperread="4096" maxnametablecharcount="16384" />
             <reliablesession ordered="true" inactivitytimeout="00:10:00"
                enabled="false" />
            <!-- transport works, without certificate-->
            <security mode="transport">
              <transport clientcredentialtype="certificate" />
            </security>
          </binding>
       </wshttpbinding>
    </bindings>
    <behaviors>
      <endpointbehaviors>
        <behavior name="clientcertificatebehavior">
          <clientcredentials>
            <clientcertificate findvalue="cn=tokencertificate" storelocation="localmachine" storename="my" x509findtype="findbysubjectname" />
          </clientcredentials>
        </behavior>
      </endpointbehaviors>
    </behaviors>
  </system.servicemodel>
</configuration>

when browse https://token1.mycompany.com/tokenapplicationservice.svc?wsdl

403 - forbidden: access denied.
not have permission view directory or page using credentials supplied.

i tried use svcutil.exe generate client-side web.config, error

the remote server returned error: (405) method not allowed.

i appreciate help.

hi,

 

as problem related wcf, quick , accurate response question, recommended initial new thread in wcf forum. support professional there more familiar , can in more efficient way.

 

windows communication foundation (wcf)

http://social.msdn.microsoft.com/forums/en-us/wcf/threads/

 

hope issue resolved soon.

 

regards,

bruce

Windows Server  >  Security