Question

Is there any way to pull information about which client certificate was used inside of my web service method when using <security mode="Transport>? I sifted through OperationContext.Current but couldn’t find anything obvious.

My server configuration is as follows:

  <basicHttpBinding>
    <binding name="SecuredBasicBindingCert">
      <security mode="Transport">
        <message clientCredentialType="Certificate" />
      </security>
    </binding>
  </basicHttpBinding>

I’m working with a third party pub/sub system who is unfortunately using DataPower for authentication. It seems like if I’m using WCF with this configuration, then I’m unable to glean any information about the caller (since no credentials are actually sent).

I somehow need to be able to figure out whose making calls to my service without changing my configuration or asking them to change their payload.

Answer 1

Yes, but it’s unintuitive.

First, be sure and reference the System.IdentityModel assembly from your service library.

Now, add something similar the following to your service method where you would like to know about the client certificate:

// Find the certificate ClaimSet associated with the client
foreach (ClaimSet claimSet in OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets)
{
    X509CertificateClaimSet certificateClaimSet = claimSet as X509CertificateClaimSet;
    if (certificateClaimSet != null)
    {
        // We found the ClaimSet, now extract the certificate
        X509Certificate2 certificate = certificateClaimSet.X509Certificate;

        // Do something interesting with information contained in the certificate
        Debug.Print("Certificate Subject: " + certificate.Subject);
    }
}

Hope this helps!