Creating .NET web service with client certificate authentication -

i want limit access .net web service specific list of clients. attach client certificate every request , proper response if "on list".

but how , best way implement this?

on iis (7.0) can set require client certificate option, specify client certificates allow access? need public part of client certificates in certificate store of web server machine?

or must setup handled in code, somehow extract client certificate id , match local list?

or way?

one way create wcf service on iis7 security requirements follows.

in order host wcf service may need run following command on web server:

"%windir%\microsoft.net\framework\v3.0\windows communication foundation\servicemodelreg.exe" -r –y 

on iis set site https binding (only) , under ssl settings set require ssl , require client certificates.

this alone allow access service (and wsdl) client certificate valid , issuer trusted web server.

in order restrict access specific certificates setup wcf configuration file bindingconfiguration as:

<basichttpbinding>   <binding name="mybasichttpbinding">     <security mode="transport">       <transport clientcredentialtype="certificate" />     </security>   </binding> </basichttpbinding> 

and behaviorconfiguration custom certificate validator as:

<behaviors>   <servicebehaviors>     <behavior name="myservicebehavior">       <servicemetadata httpgetenabled="false" httpsgetenabled="true" />       <servicedebug includeexceptiondetailinfaults="false" />       <servicecredentials>         <clientcertificate>           <authentication certificatevalidationmode="custom"             customcertificatevalidatortype="<project-namespace>.clientcertificatevalidator, <project-namespace>"/>         </clientcertificate>       </servicecredentials>     </behavior>   </servicebehaviors> </behaviors> 

and lastly implement custom validator in new class in project as:

public class clientcertificatevalidator : x509certificatevalidator {     public override void validate(x509certificate2 certificate)     {       if (certificate.thumbprint != <allowed-thumbprint>)         throw new exception();     } }