Hey,
I have a strange situation.
I have created a WCF service that takes a client certificate (coming
from a smartcard).
When I check the AuthorizationContext and look for the claimset
corresponding to that certificate I can find it.
Then I look to the issuer of that claimset, looking if it was issued
by the right authority:
When I run this service in a console (selfhosted) I get a
System.IdentityModel.Claims.X509CertificateClaimSet as the issuer of
the client certificate. when I run the same service in IIS (same code,
app.config=>web.config) I get a
System.IdentityModel.Claims.X509CertificateClaimSet.X500DistinguishedNameClaimSet
as issuer containing much less information!!
How can this be? The behavior is different but it's the same service ...
Is it a rights issue?
Thanks in advance
Kristof
Dominick Baier - 28 Jan 2008 05:45 GMT
whats you binding and binding configuration?
-----
Dominick Baier (http://www.leastprivilege.com)
Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)
> Hey,
>
[quoted text clipped - 17 lines]
> Thanks in advance
> Kristo
Kristof - 04 Feb 2008 07:50 GMT
Hey,
I took me many hours more to finally realize that the problem was
that the certificates belonging to the client certificate trust chain
were not readable from the “NETWORK SERVICE” account. I copied them
over to the Local computer store and all worked great.
(Well I had some other issues, but they are also solved now )
The conclusion is that when WCF can’t read the certificates in the
chain, I has much less information to fill up the issuer claimset and
so it becomes an other claimset type! It’s logical once you have found
it …
Thanks
Kristof Clevers