y - Net Developer

CHAPTER 7 ■ IMPLEMENTING WCF SECURITY 229ramrameshreddy.blog.com}}System.ServiceModel.ChannelFactory cf =new ChannelFactory(binding,address);cf.Credentials.ClientCertificate.SetCertificate(StoreLocation.CurrentUser,StoreName.My,X509FindType.FindBySubjectName,"WCFUser");cf.Credentials.ServiceCertificate.SetDefaultCertificate(StoreLocation.CurrentUser,StoreName.My,X509FindType.FindBySubjectName,"localhost");ITradeService proxy = cf.CreateChannel();//.... The rest of the code is unchanged.}The code is similar to service code. You will initially set the security mode as Message.Then you inform the runtime that the clients will be using certificates to authenticatethemselves. Then you set the WCFUser certificate credentials. You use the SetCertificatemethod that specifies the StoreLocation and StoreName and ask the certificate to befound using the subject name. This certificate will give all the information a client willneed to present to the server to authenticate. Then you try to set the server’s certificate.Please remember the service needs to authenticate itself to the Windows runtime. Thiscertificate information can be available only to a valid client. Therefore, you minimizethe risk of an intruder getting access to the service by presenting a single compromisedclient certificate under this design (that is, the client needs to know both the client andserver certificate information to gain access to the service).3. The App.config file for both the service and the client is simple. They have to onlydefine the endpoint of the TradeService since you have implemented the security settingsin the code. Compile and build the service and the client. First run the serviceand then the client. You should view images that are similar to Figure 7-1, Figure 7-2,and Figure 7-3.It is also beneficial to analyze the messages that travel between the service and the client.You will be able to view the encrypted message data using SvcTraceView.exe. (Please consultChapter 6 to learn about SvcTraceViewer.exe, how to implement it, and its location.) This viewwill enable the user to analyze every message that transfers between the client and the service.This will enhance your knowledge regarding the “under-the-covers” WCF implementation tofacilitate message-level security. (Figure 7-6 illustrates how the certificate claim set in the messageheader was understood by the server authentication system.) The next step is to learnabout mixed mode security.ramrameshreddyramrameshreddy