Re: Capturing a Client Cert and Passing it to a Secure Web Service

#1

It doesn't work that way. SSL client certificate authentication involves
the client with the client certificate signing part of the request with the
private key for the certificate in question in order to assert ownership of
the private key for the certificate. You won't have that private key on the
server side of the request, so you can't "forward" or "delegate" the user's
client certificate authentication to another service.

If you want to do delegation, you probably need to look at an authentication
protocol that supports delegation like Kerberos.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"hepsubah" <doug (AT) dastanley (DOT) com> wrote

Quote:

I'm trying to capture a client cert in my ASP.NET application, and use
that cert as the client cert for a call to secure web service.

I've used the following code, but am getting a 403 error on the
invocation of the service. All the service is supposed to do is
return the subject of the passed cert (I'll do more with it later)

-----------------------------------------------------------------------------------------------------------------------------------------
protected void Page_Load(object sender, EventArgs e)
{
// Capture Client Certificate
HttpClientCertificate cs = Request.ClientCertificate;
string svcres;

try
{

// Create X509 Cert from Client Cert
X509Certificate x509 = new
X509Certificate(cs.Certificate);

// Instantiate the Servive
TestCertService.Service ts = new
TestCertService.Service();

// Add the Captured Cert
ts.ClientCertificates.Add(x509);

// Invoke the Service
svcres = ts.CertSubject();

Response.Write(" Cert from Service ");

Response.Write("-------------------------------------------------------
br>");
Response.Write("Subject = " + svcres + " ");
}
catch (Exception ex)
{
if (ex is WebException)
{
WebException we = ex as WebException;

Response.Write("WebError Invoking Service = Message:"
+ we.Message + " ");
}
else
{
Response.Write("Error Invoking Service = Message:" +
ex.Message + " ");
}
}
-------------------------------------------------------------------------------------------------------------------------------------------------

Is this approach sound?

Is this a security issue?

Any help would be appreciated

#2

On Aug 28, 3:08 pm, "Joe Kaplan"
<joseph.e.kap... (AT) removethis (DOT) accenture.com> wrote:

Quote:

It doesn't work that way. SSL client certificate authentication involves
the client with the client certificate signing part of the request with the
private key for the certificate in question in order to assert ownership of
the private key for the certificate. You won't have that private key on the
server side of the request, so you can't "forward" or "delegate" the user's
client certificate authentication to another service.

If you want to do delegation, you probably need to look at an authentication
protocol that supports delegation like Kerberos.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net
--"hepsubah" <d... (AT) dastanley (DOT) com> wrote in message

news:1188333518.117323.265320 (AT) g4g2000hsf (DOT) googlegroups.com...

I'm trying to capture a client cert in my ASP.NET application, and use
that cert as the client cert for a call to secure web service.

I've used the following code, but am getting a 403 error on the
invocation of the service. All the service is supposed to do is
return the subject of the passed cert (I'll do more with it later)

-----------------------------------------------------------------------------------------------------------------------------------------
protected void Page_Load(object sender, EventArgs e)
{
// Capture Client Certificate
HttpClientCertificate cs = Request.ClientCertificate;
string svcres;

try
{

// Create X509 Cert from Client Cert
X509Certificate x509 = new
X509Certificate(cs.Certificate);

// Instantiate the Servive
TestCertService.Service ts = new
TestCertService.Service();

// Add the Captured Cert
ts.ClientCertificates.Add(x509);

// Invoke the Service
svcres = ts.CertSubject();

Response.Write(" Cert from Service ");

Response.Write("-------------------------------------------------------
br>");
Response.Write("Subject = " + svcres + " ");
}
catch (Exception ex)
{
if (ex is WebException)
{
WebException we = ex as WebException;

Response.Write("WebError Invoking Service = Message:"
+ we.Message + " ");
}
else
{
Response.Write("Error Invoking Service = Message:" +
ex.Message + " ");
}
}
-------------------------------------------------------------------------------------------------------------------------------------------------

Is this approach sound?

Is this a security issue?

Any help would be appreciated

Thanks

#3

On Aug 28, 3:08 pm, "Joe Kaplan"
<joseph.e.kap... (AT) removethis (DOT) accenture.com> wrote:

Quote:

It doesn't work that way. SSL client certificate authentication involves
the client with the client certificate signing part of the request with the
private key for the certificate in question in order to assert ownership of
the private key for the certificate. You won't have that private key on the
server side of the request, so you can't "forward" or "delegate" the user's
client certificate authentication to another service.

If you want to do delegation, you probably need to look at an authentication
protocol that supports delegation like Kerberos.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net
--"hepsubah" <d... (AT) dastanley (DOT) com> wrote in message

news:1188333518.117323.265320 (AT) g4g2000hsf (DOT) googlegroups.com...

I'm trying to capture a client cert in my ASP.NET application, and use
that cert as the client cert for a call to secure web service.

I've used the following code, but am getting a 403 error on the
invocation of the service. All the service is supposed to do is
return the subject of the passed cert (I'll do more with it later)

-----------------------------------------------------------------------------------------------------------------------------------------
protected void Page_Load(object sender, EventArgs e)
{
// Capture Client Certificate
HttpClientCertificate cs = Request.ClientCertificate;
string svcres;

try
{

// Create X509 Cert from Client Cert
X509Certificate x509 = new
X509Certificate(cs.Certificate);

// Instantiate the Servive
TestCertService.Service ts = new
TestCertService.Service();

// Add the Captured Cert
ts.ClientCertificates.Add(x509);

// Invoke the Service
svcres = ts.CertSubject();

Response.Write(" Cert from Service ");

Response.Write("-------------------------------------------------------
br>");
Response.Write("Subject = " + svcres + " ");
}
catch (Exception ex)
{
if (ex is WebException)
{
WebException we = ex as WebException;

Response.Write("WebError Invoking Service = Message:"
+ we.Message + " ");
}
else
{
Response.Write("Error Invoking Service = Message:" +
ex.Message + " ");
}
}
-------------------------------------------------------------------------------------------------------------------------------------------------

Is this approach sound?

Is this a security issue?

Any help would be appreciated

Thanks

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Re: Capturing a Client Cert and Passing it to a Secure Web Service

Dotnet Security microsoft.public.dotnet.security

Re: Capturing a Client Cert and Passing it to a Secure Web Service - 08-28-2007 , 06:08 PM

Re: Capturing a Client Cert and Passing it to a Secure Web Service - 08-28-2007 , 06:51 PM

Re: Capturing a Client Cert and Passing it to a Secure Web Service - 08-28-2007 , 06:51 PM