If somebody else wants to do this, here are some snippets to get you underway:
/// <summary>
/// WCF Message inspector to hunt out those client certificates and pass onto BizTalk
/// </summary>
/// <remarks>
/// Fails silently to allow anonymous activity to continue, change as required.
/// Author: Alastair Grant
/// </remarks>
public class ClientCertificatePromotionInspector : System.ServiceModel.Dispatcher.IDispatchMessageInspector
{
#region IDispatchMessageInspector Members
public object AfterReceiveRequest(ref System.ServiceModel.Channels.Message request, IClientChannel channel, InstanceContext instanceContext)
{
try
{
if(OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets.Count > 0)
{
System.Security.Cryptography.X509Certificates.X509Certificate2 clientCert = ((X509CertificateClaimSet)OperationContext.Current.ServiceSecurityContext.AuthorizationContext.ClaimSets[0]).X509Certificate;
request.Headers.Add(MessageHeader.CreateHeader("ClientCertificate", "http://internal.namespace/wcf", clientCert.Thumbprint));
}
}
catch
{
}
return null;
}
public void BeforeSendReply(ref System.ServiceModel.Channels.Message reply, object correlationState)
{
}
#endregion
}
/// <summary>
/// WCF Behaviour wrapper for <see cref="ClientCertificatePromotionInspector" />
/// </summary>
public class ClientCertificatePromotionBehaviour : System.ServiceModel.Description.IServiceBehavior
{
#region IServiceBehavior Members
public void AddBindingParameters(System.ServiceModel.Description.ServiceDescription serviceDescription, ServiceHostBase serviceHostBase, System.Collections.ObjectModel.Collection<System.ServiceModel.Description.ServiceEndpoint> endpoints, System.ServiceModel.Channels.BindingParameterCollection bindingParameters)
{
}
/// <summary>
/// Adds the <see cref="ClientCertificatePromotionInspector"/> to available endpoint message inspectors
/// </summary>
/// <param name="serviceDescription"></param>
/// <param name="serviceHostBase"></param>
public void ApplyDispatchBehavior(System.ServiceModel.Description.ServiceDescription serviceDescription, ServiceHostBase serviceHostBase)
{
foreach(ChannelDispatcher channelDispatcher in serviceHostBase.ChannelDispatchers)
{
foreach(EndpointDispatcher endpointDispatcher in channelDispatcher.Endpoints)
{
endpointDispatcher.DispatchRuntime.MessageInspectors.Add(new ClientCertificatePromotionInspector());
}
}
}
public void Validate(System.ServiceModel.Description.ServiceDescription serviceDescription, ServiceHostBase serviceHostBase)
{
}
#endregion
}
/// <summary>
/// Provides information for machine.config
/// </summary>
public class ClientCertificatePromotionBehaviourElement :
System.ServiceModel.Configuration.BehaviorExtensionElement
{
public override Type BehaviorType
{
get
{
return typeof(ClientCertificatePromotionBehaviour);
}
}
protected override object CreateBehavior()
{
return new ClientCertificatePromotionBehaviour();
}
}
Register ClientCertificatePromptionBehaviourElement in the machine.config for it to be visible in the WCF behaviour list in BizTalk.
WCF headers get wrapped with XML tags when going into the BizTalk console, so you need a little decode pipeline component to extract it, I won't paste the whole class, but this is the IComponent bit:
public IBaseMessage Execute(IPipelineContext pContext, IBaseMessage pInMsg)
{
string cert = (string)pInMsg.Context.Read("ClientCertificate", "http://internal.namespace/wcf");
XmlDocument xDoc = new XmlDocument();
xDoc.LoadXml(cert);
pInMsg.Context.Write("SignatureCertificate", "http://schemas.microsoft.com/BizTalk/2003/system-properties", xDoc.DocumentElement.InnerText);
return pInMsg;
}
Used a dirty XmlDocument for demo purposes, you all know how to improve that as required.
If this is
helpful or
answers your question -
please mark accordingly.
Because I get points for it which gives my life purpose (also, it helps other people find answers quickly)
