How to add a service reference to a WCF client for a web service requiring client authentication certificate

Question

Caution, WCF noobie alert

I need to create a WCF client to query a non-WCF web service. The web service is not a WCF service. Additionally, the web service requires a client authentication certificate. Now, I have the certificate, and can create a non-WCF client that works perfectly; I was able to 'Add Web Reference' and a certificate dialog box opened up to allow me to select the appropriate certificate, then went on to create the web reference. Trying to create a WCF client via 'Add Service Reference' is another story, it just fails with a 403 Access Denied error.

I have the WSDL for the service, and have run svcutil.exe on it, but am not sure how to proceed from there.

Thanks for any help!

Answer 1

Read this article - http://msdn.microsoft.com/en-us/library/cc948997.aspx:

Summary

This how-to article walks you through the process of using client certificates and message security to authenticate your users. The article shows you how to create and install client and service certificates during development, configure the WCF service and client to use the respective certificates, and test the service with a sample WCF client.

Answer 2

I'm assuming that the service you are using is performing client SSL authentication.

Since add service reference is failing, you can use svcutil to generate the client from the WSDL file that you have. I think the syntax would be something like:

svcutil *.wsdl /l:C# /out:Reference.cs /config /s /ct:System.Collections.Generic.List`1 /ser:Auto /tcv:Version35 /n:*,<NameOfYourNamespaceHere> /edb

This will generate a file, Reference.cs, that contains the proxy classes to the service (you can give this file whatever name you want). Add this file to your project. A config file, output.config, will also be generated. You can add this configuration to your application configuration instead of typing it all in by hand.

Now you can follow this MSDN article on using Transport Security with Certificate Authentication. You can skip down to the client section where it shows how to attach the certificate to the request in code as well as in configuration.

Good luck.

Answer 3

Stupid question (maybe): could you connect to the service endpoint, present it with your credentials stored in the certificate, and then download the WSDL (and possibly XSD) from there? Or could it be the entity offering this service would be able to actually send you these files (or make them available for download)?

Once you have the WSDL (and XSD) file on disk, it should be easy enough to create WCF client for that (using either svcutil.exe or Add Service Reference) based on those files, and then configure the appropriate security for it.

Just a thought.... (worth $0.02?)

Marc

Answer 4

I know this is the old question and it has been already solved but I would like to mention that Add service reference also works for WSDL files stored on disk. Marc has also mentioned it. Add service reference dialog accepts:

• URL to WSDL
• URL to Metadata exchange endpoint
• Service URL where /mex is added internally
• Any file path to WSDL file

So if you have WSDL and all need XSD files you can use Add service reference as well. The only tricky part is that Add service reference dialog doesn't have Browse button and that is the reason why this functionality is not well known.