WCF Web Services and SSL and Certificates
I am very new to creating WCF web service. I want to create a WCF web service that must run over https for a more secure transfer of data. I have a virtual server with GoDaddy.com and installed a GoDaddy SSL certificate. I don't want the user of the web service to have to install any certificate on their machine to call the service. I just want it to be a secure transmission. Am I on the right track here?
I also don't want any authentication to happen for the service to run. Within the XML they send to the ser开发者_开发百科vice, the account information will be included and the service will determine if they have rights to update the data within the service. How can I turn off all authorization and allow the user to run the service over https and without any certificate needed on their end?
The certificate on user end is not needed only if client trusts the authority which have issued the certificate. First of all it is completely out of your control. Normally clients trusts some well known certificate authorities like VeriSign etc. So if you GoDaddy certificate has in its certificate chain trusted authority client will not have to install the certificate but if it is just issued by some GoDaddy's certificate authority client doesn't have to trust it.
Authentication and authorization in WCF service is used "on-demand" so you don't have to use it. Just use BasicHttpBinding
(SOAP) or WebHttpBinding
(REST) and set its security mode to Transport
and ClientCredentialType
for to None
like:
<bindings>
<basicHttpBinding>
<binding name="secured">
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
</basicHttpBinding>
</bindings>
Use this binding configuration for your service's endpoint.
精彩评论