0

I am developing a WCF service. I use WsHttpBinding and customUserNameValidator for access through username and password. But I've faced with problem that as soon as I use username/password I need some sort of secure channel that means that I should generate two certificates - one for the service and one for a client. The question is - is it possible to do so that client is not needed certificate and if yes - how to do that? And how to customize a security of WCF service for non-.net clients?

Don Tomato
  • 3,311
  • 3
  • 30
  • 48

2 Answers2

0

There is no need to have two certificates when using wsHttpBinding binding type. You need to set up only one certificate on the server by using TransportWithMessageCredential used for point to point channel communication where user credentials are encrypted and stored in the message.

On the following link you can find a complete sample related to wsHttpBinding with Username Authentication: http://msdn.microsoft.com/en-us/library/ff648840.aspx.

Mihai H
  • 3,291
  • 4
  • 25
  • 34
  • Creating and installing the certificate is outside the scope of this How To article. For details on how to do this, see “How To — Create and Install Temporary Certificates in WCF for Transport Security During Development” and follow Steps 1 through 4. ---- – Don Tomato Jun 28 '12 at 13:44
  • And how to create and install non-temporary cerificate (not for development)? – Don Tomato Jun 28 '12 at 13:45
  • Here is it is an article which describes how to create and install a certificate for a production server: http://blog.functionalfun.net/2008/05/how-to-create-server-certificate-for.html – Mihai H Jun 28 '12 at 13:50
0

you can set client credentials to none whilst setting up your transport and message security.

John Nicholas
  • 4,778
  • 4
  • 31
  • 50