设置IIS以要求客户端证书并使用匿名身份validation

好的，我们也和你一样。 我们反过来工作。 我们首先使用客户端和服务器证书来保护IIS。 我们在IIS Express上完成了这个工作（当我发布这个时，仍在开发中）。 我们允许在IIS express applicationhost.config中覆盖web.config的特定部分。 即： <section name="windowsAuthentication" overrideModeDefault="Allow" />

服务器端configuration：

 <sytem.serviceModel> <bindings> <wsHttpBinding> <binding name="ClientCert"> <security mode="Transport"> <transport clientCredentialType="Certificate" /> </security> </binding> </wsHttpBinding> </bindings> <behaviors> <!--We have a custom service behavior for claim based security --> <behavior name="wsHttpCertificateBehavior"> <serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" /> <serviceDebug httpHelpPageEnabled="true" includeExceptionDetailInFaults="true" /> <serviceAuthorization serviceAuthorizationManagerType="MyNamespace.AdamAuthorizationManager, MyAssembly"> <authorizationPolicies> <add policyType="MyNamespace.AdamAuthorizationPolicy, MyAssembly" /> </authorizationPolicies> </serviceAuthorization> <serviceCredentials> <serviceCertificate findValue="YourServerCertificateNameWithoutCN=" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" /> <clientCertificate> <authentication revocationMode="NoCheck" mapClientCertificateToWindowsAccount="true" /> </clientCertificate> </serviceCredentials> </behavior> </behaviors> <services> <service name="MyNamespace.OrderService" behaviorConfiguration="wsHttpCertificateBehavior"> <endpoint address="https://iisurl/OrderService.svc/ClientCert" contract="wsHttpCertificateBehavior.IOrderService" binding="wsHttpBinding" bindingConfiguration="ClientCert"> </endpoint> </service> </services> </sytem.serviceModel> <system.webServer> <security> <authentication> <windowsAuthentication enabled="true" /> <anonymousAuthentication enabled="true" /> <iisClientCertificateMappingAuthentication defaultLogonDomain="YourDomain" enabled="true" oneToOneCertificateMappingsEnabled="true"> <oneToOneMappings> <add enabled="true" certificate="Base64HashOfTheCertificate" userName="YourUserName" password="YourPassword" /> </oneToOneMappings> </iisClientCertificateMappingAuthentication> </authentication> <authorization> <add users="*" accessType="Allow" /> </authorization> <!--Require SSL *AND* require a client certificate --> <access sslFlags="Ssl, SslNegotiateCert, SslRequireCert" /> </security> </system.WebServer> 

在客户端：

 <system.serviceModel> <wsHttpBinding> <binding name="ClientCertificate"> <security mode="Transport"> <transport clientCredentialType="Certificate"/> </security> </binding> </wsHttpBinding> <behaviors> <endpointBehaviors> <behavior name="wsHttpCertificateBehavior"> <clientCredentials> <clientCertificate findValue="YourClientCertificateNameWithoutCN=" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName"/> <serviceCertificate> <authentication revocationMode="NoCheck"/> </serviceCertificate> </clientCredentials> </behavior> </endpointBehaviors> </behaviors> <client> <endpoint name="ClientCertificate" address="https://iisurl/OrderService.svc/ClientCert" contract="MyNamespace.IOrderService" binding="wsHttpBinding" bindingConfiguration="ClientCertificate" behaviorConfiguration="wsHttpCertificateBehavior"> </endpoint> </client> </system.serviceModel> 

启用跟踪，login服务以及自定义授权策略和IIS跟踪日志对我们有很大的帮助。

我们的iisurl映射到我们的主机文件127.0.0.1，所以我们有可信的证书。 对于iisClientCertificationMapping检查了这一点 。

不知道你的SSL设置是否正确。 我们有一个PowerShell脚本。 它的一些部分：

生成根证书（PowerShell）

 Invoke-Command -ScriptBlock{ . "C:\Program Files\Microsoft SDKs\Windows\v7.0A\bin\makecert.exe" -n "CN=YourRootCA" -r -sv YourRootCA.pvk YourRootCA.cer} $certFile = get-childitem $exPath | where {$_.FullName -match "GlobalVisionServicesRootCA.cer"} if ($certFile -ne $NULL) { echo "Discovered the YourRootCA.cer in the same folder as this script, installing it in the LocalMachine\Root certificate store.." $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certFile.FullName) $rootStore = new-object system.security.cryptography.x509certificates.x509Store 'Root','LocalMachine' $rootStore.Open('ReadWrite') $rootStore.Add($cert) $rootStore.Close() } 

生成服务器证书（命令行）：

 makecert.exe -sk YourDevSrvCert -iv YourRootCA.pvk -n "CN=iisurl" -ic YourRootCA.cer -sr localmachine -ss my -sky exchange -pe yourservercertificate.cer 

生成服务器客户端（命令行）：

 makecert.exe -sk ClientDevSrvCert -iv YourRootCA.pvk -n "CN=iisurl" -ic GlobalVisionServicesRootCA.cer -sr localmachine -ss my -sky exchange -pe iisurl.cer 

将证书绑定到IIS（命令行，特定于XP）：

 httpcfg.exe delete ssl -i "0.0.0.0:443" httpcfg.exe" delete urlacl url="https://iisurl:443/" httpcfg.exe set urlacl url="https://iisurl:443/" user=Everyone httpcfg.exe" set ssl -i "0.0.0.0:443" -h ThumpPrint 

将ThumpPrint更改为主题名为iisurl的证书的ThumpPrint。 我build议你完全自动化与PowerShell，我们有这个，所以我们可以在多台机器上开发。 但是我不能把它全部放在这里。

我希望这可以帮助你。 有了这个configuration，如果你通过https浏览url iisurl / OrderService它要求你提供一个客户端证书。 （在IE中）

你也可以看这个日志：C：\ WINDOWS \ system32 \ Logfiles \ HTTPERR