I need to protect a REST service that works over https. Previously we used HttpClientCredentialType.Ntlm credentials. I changed binding to the following:
var binding = new WSHttpBinding(SecurityMode.TransportWithMessageCredential, true)
{
ReaderQuotas = _readerQuotas,
MaxReceivedMessageSize = 2147483647,
OpenTimeout = TimeSpan.MaxValue,
CloseTimeout = TimeSpan.MaxValue,
SendTimeout = TimeSpan.MaxValue,
ReceiveTimeout = TimeSpan.MaxValue
};
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Certificate;
binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;
Then I set some self-signed certificate before opening the host:
host.Credentials.ClientCertificate.SetCertificate(StoreLocation.LocalMachine,
StoreName.AuthRoot, X509FindType.FindByIssuerName, "...");
host.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine,
StoreName.AuthRoot, X509FindType.FindByIssuerName, "...");
What surprised me though was that I was able to login using the old client configured using username/password credentials. How is this possible? The whole point of using certificate authentication is to disable all unwanted login attempts to minimize the risk
of password attack. Any idea how can I make sure that my service allows certificate authentication only?
