Инструкция по проверке подлинности с помощью сертификата клиента в службе WCF, защищенной ACS

using System.ServiceModel;
using System.ServiceModel.Channels;
using Microsoft.IdentityModel.Protocols.WSTrust.Bindings;

        public static Binding CreateAcsCertificateBinding()
        {
            return new CertificateWSTrustBinding(SecurityMode.TransportWithMessageCredential);
        }

        public static Binding CreateServiceBinding(string acsCertificateEndpoint)
        {
            return new IssuedTokenWSTrustBinding(CreateAcsCertificateBinding(), new EndpointAddress(acsCertificateEndpoint));
        }

    public static class Bindings
    {
        public static Binding CreateServiceBinding(string acsCertificateEndpoint)
        {
            return new IssuedTokenWSTrustBinding(CreateAcsCertificateBinding(), new EndpointAddress(acsCertificateEndpoint));
        }

        public static Binding CreateAcsCertificateBinding()
        {
            return new CertificateWSTrustBinding(SecurityMode.TransportWithMessageCredential);
        }
    }

using System.ServiceModel;

    [ServiceContract]
    public interface IStringService
    {
        [OperationContract]
        string Reverse( string value );
    }

    public class StringService : IStringService
    {
        public string Reverse( string value )
        {
            char[] chars = value.ToCharArray();
            Array.Reverse( chars );
            return new string( chars );
        }
    }

using System.Collections.Generic;
using System.IdentityModel.Tokens;
using Microsoft.IdentityModel.Tokens;
using Interfaces;

/// <summary>
    /// Implements an IssuerNameRegistry that only recognizes a specific
    /// set of issuer subject names.
    /// </summary>
    class X509IssuerNameRegistry : IssuerNameRegistry
    {
        List<string> _trustedSubjectNames = new List<string>();

        /// <summary>
        /// Constructs an instance of X509IssuerNameRegistry.
        /// </summary>
        /// <param name="trustedSubjectNames">The subject names that can be recognized.</param>
        public X509IssuerNameRegistry( params string[] trustedSubjectNames )
        {
            _trustedSubjectNames = new List<string>( trustedSubjectNames );
        }

        /// <summary>
        /// Determines what the issuer name will be on claims contained in tokens.
        /// </summary>
        /// <param name="securityToken">
        /// The security token to extract the issuer name from. This token typically signed the
        /// token containing claims and represents the issuer.
        /// </param>
        /// <returns>The issuer name to be put on claims.</returns>
        public override string GetIssuerName( SecurityToken securityToken )
        {
            X509SecurityToken x509Token = securityToken as X509SecurityToken;
            if ( x509Token != null )
            {
                //
                // Check the list of trusted/permissible issuers
                //
                if ( _trustedSubjectNames.Contains( x509Token.Certificate.SubjectName.Name ) )
                {
                    return x509Token.Certificate.SubjectName.Name;
                }
            }

            //
            // Complain in all other situations.
            //
            throw new SecurityTokenException( "Untrusted issuer." );
        }
    }

using System.Configuration;
using System.Security.Cryptography.X509Certificates;
using System.ServiceModel;
using System.ServiceModel.Security;
using Microsoft.IdentityModel.Configuration;
using Microsoft.IdentityModel.Tokens;
using Microsoft.IdentityModel.Tokens.Saml2;
using WSTrustBinding;
using Interfaces;

static string AccessControlHostName = 
ConfigurationManager.AppSettings.Get( "AccessControlHostName" );
        static string AccessControlNamespace = 
ConfigurationManager.AppSettings.Get( "AccessControlNamespace" );
        static string AccessControlSigningCertificateFilePath = 
ConfigurationManager.AppSettings.Get(
"AccessControlSigningCertificateFilePath" );
        static string ServiceAddress = 
ConfigurationManager.AppSettings.Get( "ServiceAddress" );
        static string ServiceCertificateFilePath = 
ConfigurationManager.AppSettings.Get( "ServiceCertificateFilePath" );
        static string ServiceCertificatePassword = 
ConfigurationManager.AppSettings.Get( "ServiceCertificatePassword" );

        private static X509Certificate2 GetAcsSigningCertificate()
        {
            return new X509Certificate2( AccessControlSigningCertificateFilePath );
        }

        private static X509Certificate2 GetServiceCertificateWithPrivateKey()
        {
            return new X509Certificate2( ServiceCertificateFilePath, ServiceCertificatePassword );
        }

        private static ServiceHost CreateWcfServiceHost()
        {
            string acsUsernameEndpoint = String.Format( "https://{0}.{1}/v2/wstrust/13/username", AccessControlNamespace, AccessControlHostName );

            ServiceHost rpHost = new ServiceHost( typeof( StringService ) );

            rpHost.Credentials.ServiceCertificate.Certificate = GetServiceCertificateWithPrivateKey();

            rpHost.AddServiceEndpoint( typeof( IStringService ),
                                       Bindings.CreateServiceBinding( acsUsernameEndpoint ),
                                       ServiceAddress );

            //
            // This must be called after all WCF settings are set on the service host so the
            // Windows Identity Foundation token handlers can pick up the relevant settings.
            //
            ServiceConfiguration serviceConfiguration = new ServiceConfiguration();
            serviceConfiguration.CertificateValidationMode = X509CertificateValidationMode.None;

            // Accept ACS signing certificate as Issuer.
            serviceConfiguration.IssuerNameRegistry = new X509IssuerNameRegistry( GetAcsSigningCertificate().SubjectName.Name );

            // Add the SAML 2.0 token handler.
            serviceConfiguration.SecurityTokenHandlers.AddOrReplace( new Saml2SecurityTokenHandler() );

            // Add the address of this service to the allowed audiences.
            serviceConfiguration.SecurityTokenHandlers.Configuration.AudienceRestriction.AllowedAudienceUris.Add( new Uri( ServiceAddress ) );

            FederatedServiceCredentials.ConfigureServiceHost( rpHost, serviceConfiguration );

            return rpHost;
        }

  <appSettings>
    <!-- ACS v2 configuration -->
    <add key="AccessControlHostName" value="accesscontrol.windows.net"/>
    <add key="AccessControlNamespace" value="...update to your service namespace..."/>
    <add key="AccessControlSigningCertificateFilePath" value="...update to path to ACS signing certificate (.cer)..." />
    
    <!-- Service configuration -->
    <add key="ServiceAddress" value="...update to your service address..." />
    <add key="ServiceCertificateFilePath" value="...update to your service certificate path..."/>
    <add key="ServiceCertificatePassword" value="...update to your service certificate password..."/>
  </appSettings>

ServiceHost rpHost = CreateWcfServiceHost();

            rpHost.Open();

            Console.WriteLine( "StringService has been started." );
            Console.WriteLine();
            Console.WriteLine( "Press <ENTER> to exit" );
            Console.WriteLine();
            Console.ReadLine();

            rpHost.Close();

StringService has been started.
Press <ENTER>  to exit

HTTP could not register URL http://+:7000/Service/Default.aspx/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details).

using System.Configuration;
using System.Diagnostics;
using System.Security.Cryptography.X509Certificates;
using System.ServiceModel;
using System.ServiceModel.Channels;
using System.ServiceModel.Security;
using Interfaces;
using WSTrustBinding;

        static string AccessControlHostName       = 
ConfigurationManager.AppSettings.Get( "AccessControlHostName" );
        static string AccessControlNamespace      = 
ConfigurationManager.AppSettings.Get( "AccessControlNamespace" );

        static string ServiceAddress              = 
ConfigurationManager.AppSettings.Get( "ServiceAddress" );
        static string ServiceCertificateFilePath  = 
ConfigurationManager.AppSettings.Get( "ServiceCertificateFilePath" );


        static string ClientCertificateFilePath   = ConfigurationManager.AppSettings.Get("ClientCertificateFilePath");
        static string ClientCertificatePassword   = ConfigurationManager.AppSettings.Get("ClientCertificatePassword");


        private static ChannelFactory<IStringService> CreateChannelFactory(string acsEndpoint, string serviceEndpoint)
        {
            //
            // The WCF service endpoint host name may not match the service certificate subject.
            // By default, the host name is 'localhost' and the certificate subject is 'WcfServiceCertificate'.
            // Create a DNS Endpoint identity to match WcfServiceCertificate.
            //
            EndpointAddress serviceEndpointAddress = new EndpointAddress( new Uri( serviceEndpoint ), 
                                                                          EndpointIdentity.CreateDnsIdentity( GetServiceCertificateSubjectName() ),
                                                                          new AddressHeaderCollection() );

            ChannelFactory<IStringService> stringServiceFactory = new ChannelFactory<IStringService>(Bindings.CreateServiceBinding(acsEndpoint), serviceEndpointAddress);

            // Set the service credentials and disable certificate validation to work with sample certificates
            stringServiceFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
            stringServiceFactory.Credentials.ServiceCertificate.DefaultCertificate = GetServiceCertificate();

            // Set the client credentials.
            stringServiceFactory.Credentials.ClientCertificate.Certificate = GetClientCertificateWithPrivateKey();


            return stringServiceFactory;
        }
        private static X509Certificate2 GetClientCertificateWithPrivateKey()
        {
            return new X509Certificate2(ClientCertificateFilePath, ClientCertificatePassword);
        }

        private static X509Certificate2 GetServiceCertificate()
        {
            return new X509Certificate2( ServiceCertificateFilePath );
        }

        private static string GetServiceCertificateSubjectName()
        {
            const string cnPrefix = "CN=";
            string subjectFullName = GetServiceCertificate().Subject;
            Debug.Assert( subjectFullName.StartsWith( cnPrefix ) );
            return subjectFullName.Substring( cnPrefix.Length );
        }

            Console.WriteLine( "Enter a string to reverse, then press <ENTER>" );
            string userInputString = Console.ReadLine();
            Console.WriteLine();

            string acsUsernameEndpoint = String.Format( "https://{0}.{1}/v2/wstrust/13/username", AccessControlNamespace, AccessControlHostName );

            ChannelFactory<IStringService> stringServiceFactory = CreateChannelFactory (acsUsernameEndpoint, ServiceAddress );
            IStringService stringService = stringServiceFactory.CreateChannel();
            ICommunicationObject channel = (ICommunicationObject)stringService;

            string outputString = stringService.Reverse( userInputString );

            Console.WriteLine( "Service responded with: " + outputString );
            Console.WriteLine();
            Console.WriteLine( "Press <ENTER> to exit" );
            Console.ReadLine();

            channel.Close();

<appSettings>
    <!-- ACS v2 configuration -->
    <add key="AccessControlHostName" value="accesscontrol.windows.net"/>
    <add key="AccessControlNamespace" value="...update to your service namespace..."/>

    <!-- Service configuration -->
    <add key="ServiceAddress" value=" " />
    <add key="ServiceCertificateFilePath" value="..path to service certificate file (.CER).. "/>

    <!-- Client configuration -->
    <add key="ClientCertificateFilePath" value="..path to client certificate (.PFX).."/>    
    <add key="ClientCertificatePassword" value="..pfx file password.."/>
    
  </appSettings>

StringService has been started.
Press <ENTER>  to exit

Enter a string to reverse, then press <ENTER>

hello world!
Service responded with: !dlrow olleh
Press <ENTER> to exit