What I would like to do is have a wcf service be anonymous accessible using a https url.
I have created a WCF in a .net 4.0. Deployed the wcf on a server that is set up to use HTTPS. The server's IIS is set to allow anonymous calls. I can access the WCF's Service.svc's website url and the Service.svc page comes up with no issues. When I click on the wsdl url link on the Service.svc, I get back either a HTTP 404 error or HTTP 401 error. The wcf's wsdl virtual directory, (I am guessing), won't allow me to get to the wsdl file.
I have set the serviceMetadata's property httpsGetEnabled to true.
wsHttpBinding's security to transport and the clientCredentialType is set to none.
basicHttpBinding's security to transport and the clientCredentialType is set to none.
Is it absolutely certain, I need to create a certificate? Because when I use VS2010 in another project and add the WCF as a Service Reference, a pop-up certificate dialog box appears and I click okay and it continues onward. But it stops when the project can't grab the wsdl flie.
How can I get to the service.svc's wsdl?
Thanks.
If you browse to the deployed service endpoint, you'll see a screen that has a link to generating the WSDL. You do need a certificate for SSL -- just create a self-signed one (it's pretty easy). Don't forget to set up your https bindings too for your site in IIS.
Related
I have a working WCF Service, that does what it should do, hosted by an IIS.
Now in another environment, this service shall be used as ever, but IIS should additionally require a client certificate for allowing to access.
So I generated some certificates, used iisClientCertificateMappingAuthentication to configure them and map them to users. So I can control which users can access the website and I see to what user the certificates are mapped in the FailedReqLogFiles.
Then I added a sub directory, put the WCF application in there, converted to an application with an apppool and ther the pain began.
The WCF Service is determined to demand that 'Anonymous authentication' must be activated. When I activate anonymous authenticaiton, the service can be invoked, but from then on, it doesn't matter which certificate is used for authentication.
I googled tons of articles and tried lots of configurations, but didn't success so far. I must admit, I'm not very familiar with WCF, this always drove me crazy. I do simply not understand why an application deals with the way the Webserver handles security (it's smiliar to adding SSL, when WCF is not configured properly, IIS shows 404, that's also one thing i do not understand, why the WCF is interfering with the way IIS exposes content to the world...).
Hope there's someone who could give advice, thank you very much in advance.
Regards, Chris
You could try below setting in iis to resolve the issue:
1)Open iis manager, select your site.
2)select the SSL setting from the middle pane.
3)in SSL setting check require SSL, client certificate select accept radio button.
4)click on apply and restart iis.
You could refer the below link for how to set iisclientcertificate authentication with WCF:
WCF Service Using Client Certificates Requires Anonymous Access in IIS and Therefore Doesn't Actually Work?
How do I implement Client Certificate authentication the right way?
https://learn.microsoft.com/en-us/iis/configuration/system.webServer/security/authentication/iisClientCertificateMappingAuthentication/
I have a WCF service that I have set up to be consumed via HTTPS. Unfortunately when my client tries to consume it he immediately gets an error because the referenced schema locations generated in the WSDL are set as HTTP which throws an error when he tries to reference it in a client project. Indeed from his network he cannot get to the XSD via the HTTP URL however, if he pastes the URL into a browser and changes the HTTP to HTTPS then he can see it.
So is there anyway that I can specify the proper generation of the URL, i.e. as HTTPS?
FYI... Our environment does not use SSL or certs, using WAF and a proxy instead.
i have a wcf rest service hosted on iis which is ssl enabled. i have both a console application and a browser as client. Is it possible to implement ssl on the console app? is possible, any idea or links to related resources will be greatly helpful.
If you want to use mutual SSL with a REST service from your console application, you can use the WebChannelFactory class.
http://msdn.microsoft.com/en-us/library/bb908674.aspx
The client certificate is set using the WebChannelFactory.Credentials property. The advantage of this approach is that you can set the certificate in connnnfiguration so you can change it later without recompiling.
Alternatively, you can use the HttpWebRequest class and its ClientCertificates property.
i have a silverlight app connected to a webservice over https.
The webservice is hosted on mydomain.com (not localhost).
When i run the silverlight, it makes https calls to webservice on mydomain.com, but also tries to access "http://localhost/clientaccesspolicy.xml" and fails obviously. Why is my SL app looking for cal.xml in localhost? why is it not looking for cal.xml in the mydomain.com?
Appreciate your thoughts.
Thanks!
"Before allowing a connection to a network resource, the Silverlight runtime will try to download a security policy file from the domain that hosts the network resource. There are two different methods used to download the security policy that depend on whether the connection request was from a WebClient or HTTP class or whether the connection request was from sockets.
If the connection request was from a WebClient or an HTTP class to a cross-domain site, the Silverlight runtime tries to download the security policy file using the HTTP protocol. The Silverlight runtime first tries to download a Silverlight policy file with a name of "clientaccesspolicy.xml" at the root of the requested target domain using the HTTP protocol.
If the "clientaccesspolicy.xml" is either not found (the web request returns a 404 status code), returned with an unexpected mime-type, is not valid XML, or has an invalid root node, then the Silverlight runtime will issue a request for a for the Flash policy file with a name of "crossdomain.xml" at the root of the requested target domain, using the HTTP protocol."
http://msdn.microsoft.com/en-us/library/cc645032%28VS.95%29.aspx
What does the address look like inside your SL application?
Is the address coming from the ServiceReference.ClientConfig file? If so, make sure that it has a mydomain.com and not a localhost address there.
Caution, WCF noobie alert
I need to create a WCF client to query a non-WCF web service.
The web service is not a WCF service. Additionally, the web service requires a client authentication certificate. Now, I have the certificate, and can create a non-WCF client that works perfectly; I was able to 'Add Web Reference' and a certificate dialog box opened up to allow me to select the appropriate certificate, then went on to create the web reference. Trying to create a WCF client via 'Add Service Reference' is another story, it just fails with a 403 Access Denied error.
I have the WSDL for the service, and have run svcutil.exe on it, but am not sure how to proceed from there.
Thanks for any help!
I'm assuming that the service you are using is performing client SSL authentication.
Since add service reference is failing, you can use svcutil to generate the client from the WSDL file that you have. I think the syntax would be something like:
svcutil *.wsdl /l:C# /out:Reference.cs /config /s /ct:System.Collections.Generic.List`1 /ser:Auto /tcv:Version35 /n:*,<NameOfYourNamespaceHere> /edb
This will generate a file, Reference.cs, that contains the proxy classes to the service (you can give this file whatever name you want). Add this file to your project. A config file, output.config, will also be generated. You can add this configuration to your application configuration instead of typing it all in by hand.
Now you can follow this MSDN article on using Transport Security with Certificate Authentication. You can skip down to the client section where it shows how to attach the certificate to the request in code as well as in configuration.
I know this is the old question and it has been already solved but I would like to mention that Add service reference also works for WSDL files stored on disk. Marc has also mentioned it. Add service reference dialog accepts:
URL to WSDL
URL to Metadata exchange endpoint
Service URL where /mex is added internally
Any file path to WSDL file
So if you have WSDL and all need XSD files you can use Add service reference as well. The only tricky part is that Add service reference dialog doesn't have Browse button and that is the reason why this functionality is not well known.
Stupid question (maybe): could you connect to the service endpoint, present it with your credentials stored in the certificate, and then download the WSDL (and possibly XSD) from there? Or could it be the entity offering this service would be able to actually send you these files (or make them available for download)?
Once you have the WSDL (and XSD) file on disk, it should be easy enough to create WCF client for that (using either svcutil.exe or Add Service Reference) based on those files, and then configure the appropriate security for it.
Just a thought.... (worth $0.02?)
Marc
OK, bit of a work-around here (and I've no idea what is going on technically): I noticed that when you add a Web Reference, the certificate you have chosen is cached and automatically used the next time you add the Web Reference (I noticed because I'd chosen the wrong certificate). This caching seems to work across Web Reference and Service Reference so:
Add a Web Reference to the endpoint, choosing the certificate you wish to use
Remove this Web Reference
Add a Service Reference to the same endpoint and Visual Studio will use the same certificate you chose for the Web Reference
Worked on Visual Studio Community 2019, v16.7.7