title: Self-Hosted WCF Service with Mutual SSL (between Service and Client) fails with 403 Forbidden
body: <p>I’m trying to setup a demo of Mutual SSL between a <em>self-hosted</em> WCF service and a client app (command prompt for now).  In the end I’m trying to get to a solution where I have <em>transport security</em> (not message security) between a server that uses a certificate for its incoming connections and multiple clients each with individual certs that I can use to uniquely identify each of the clients.</p>
  
  <p>I’ve tried a number of differing approaches to this, but none have worked (I was unable to find an exact example for what I’ve been trying to do).  Each time I think I’m getting close I end up with an exception in the client when I try to invoke the service.  The most common exception I’ve run into is:</p>
  
  <pre><code>“The HTTP request was forbidden with client authentication scheme 'Anonymous'.”
  Inner exception: "The remote server returned an error: (403) Forbidden."
  </code></pre>
  
  <p>Does anyone have any thoughts on what I might have done wrong or perhaps a better walk through of how to setup mutual SSL in the above scenario?</p>
  
  <p>Full disclosure - as of right now I am running both the client and server on the same computer.  Not sure if that matters.</p>
  
  <p>Config snippets below</p>
  
  <p>The service and client code is relatively trivial so I’m pretty confident that I’ve gotten them to work.  The app configs (specifically the bindings and behaviors) and certs are “more interesting” so I’m not as confident there.</p>
  
  <p>How I created the certs (actual commands verbatim)</p>
  
  <pre><code>makecert -pe -n "CN=SelfSignedCA" -ss Root -sr LocalMachine  -a sha1 -sky signature -r -sv "SelfSignedCA.cer" "SelfSignedCA.pvk"
  makecert -pe -n "CN=system" -ss my -sr LocalMachine -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1  -in "SelfSignedCA" -is Root -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 Service.cer
  makecert -pe -n "CN=client1" -ss my -sr LocalMachine -a sha1 -sky exchange -eku 1.3.6.1.5.5.7.3.1  -in "SelfSignedCA" -is Root -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 Client1.cer
  </code></pre>
  
  <p>Associating the Cert with the port (actual commands verbatim)</p>
  
  <pre><code>netsh http add urlacl url=https://+:44355/MyService/ user=EVERYONE
  </code></pre>
  
  <p><strong>Server Settings</strong></p>
  
  <p>Bindings:</p>
  
  <pre><code>  &lt;wsHttpBinding&gt;
      &lt;binding name="CustomBinding"&gt;      
        &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="Certificate"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>Behaviors:</p>
  
  <pre><code>    &lt;serviceBehaviors&gt;
        &lt;behavior name=""&gt;
        &lt;!--
        &lt;serviceCredentials&gt;
          &lt;serviceCertificate
             findValue="system"
             storeLocation="LocalMachine"
             storeName="My"
             x509FindType="FindBySubjectName"/&gt;
        &lt;/serviceCredentials&gt;
        --&gt;
        &lt;serviceAuthorization
           serviceAuthorizationManagerType=
                "ClientAuthorization.ClientCertificateAuthorizationManager, Simulator.Service.SideA" /&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  </code></pre>
  
  <p><strong>Client</strong></p>
  
  <p>Bindings:</p>
  
  <pre><code>  &lt;wsHttpBinding&gt;
      &lt;binding name="CustomBinding"&gt;      
        &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="Certificate"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>Behaviors</p>
  
  <pre><code>  &lt;endpointBehaviors&gt;
      &lt;behavior name="ChannelManagerBehavior"&gt;
        &lt;clientCredentials&gt;
           &lt;clientCertificate findValue="client1"
                             storeLocation="LocalMachine"
                             storeName="My"
                             x509FindType="FindBySubjectName" /&gt;
          &lt;!--
          &lt;serviceCertificate&gt;
            &lt;authentication certificateValidationMode="PeerOrChainTrust"/&gt;
          &lt;/serviceCertificate&gt;
          --&gt;
        &lt;/clientCredentials&gt;
       &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>So I added a custom username and password validator to the server in an attempt to override the default behavior and always allow regardless of the credentials presented (again I really don't want username/password validation).  <strong>This validator never gets invoked.</strong>  The Client still gets the "authentication scheme 'Anonymous'.” exception.</p>
  
  <p>Service Behavior Update</p>
  
  <pre><code>  &lt;serviceCredentials&gt;
      &lt;userNameAuthentication 
        userNamePasswordValidationMode="Custom"
        customUserNamePasswordValidatorType=
          "Service.ClientAuthorization.ClientUserNamePasswordValidatorManager, Service.SideA" /&gt;
    &lt;/serviceCredentials&gt;
  </code></pre>