dotnet web services enhancements:
I'm working in a Mutual X509 context, i can define the authorized clients
into the wse policy config file using something like:

<authorization>
<allow user="CN=WSE2QuickStartClient" />
<deny user="*" />
</authorization>

But i want add programmatically the users allowed to use the web service.
So How can i do it? I tried making a custom assertion, and into the
CreateServiceInputFilter adding to the context an AuthorizationAssertion:

public override SoapFilter CreateServiceInputFilter(FilterCreationContext
context)
{
auth = new AuthorizationAssertion();
auth.Rules.Add(new AccessCheckRule(true, "CN=WSE2QuickStartClient"));
auth.Rules.Add(new AccessCheckRule(false, "*"));

context.Policy.Assertions.Add(auth);
return base.CreateServiceInputFilter(context);
}

this doesn't work: allways allow use the web service :(

I think you need to apply this change to your code:

public override SoapFilter CreateServiceInputFilter(FilterCreationContext
context)
{
auth = new AuthorizationAssertion();
auth.Rules.Add(new AccessCheckRule(true, "CN=WSE2QuickStartClient"));
auth.Rules.Add(new AccessCheckRule(false, "*"));

return auth.CreateServiceInputFilter(context);
}

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax


[quoted text, click to view]

I tried with your answer but it didn't work...The code at the service is
something like:

public class CertAssertion : MutualCertificate11Assertion
{ ...

public override SoapFilter
CreateServiceInputFilter(FilterCreationContext context)
{
auth = new AuthorizationAssertion();
auth.Rules.Add(new AccessCheckRule(true,
"CN=WSE2QuickStartClient"));
auth.Rules.Add(new AccessCheckRule(false, "*"));
return auth.CreateServiceInputFilter(context);
}
}

The input trace file, looks like:

Entering SOAP filter
Microsoft.Web.Services3.Design.AuthorizationAssertion+AuthorizationFilter

Exception thrown: Identity token not found. Authorization assertion requires
identity token to be supplied by security assertion that runs prior to
authorization. at
Microsoft.Web.Services3.Design.AuthorizationAssertion.GetPrincipal(SoapEnvelope
envelope, RoleProvider roleProvider) at
Microsoft.Web.Services3.Design.AuthorizationAssertion.AuthorizationFilter.ProcessMessage(SoapEnvelope
envelope) at
Microsoft.Web.Services3.Pipeline.ProcessInputMessage(SoapEnvelope envelope)

Maybe i need add something into the client? The policy at the client side,
is only a MutualCertificate11Assertion, without a custom assertion...

Thanks a lot!

I know what the problem is, you do not have to override the
MutualCertificate11Assertion to create your own authorization assertion.

You should create a new assertion, something like this,

public class CertAssertion : PolicyAssertion
{ ...

public override SoapFilter
CreateServiceInputFilter(FilterCreationContext context)
{
auth = new AuthorizationAssertion();
auth.Rules.Add(new AccessCheckRule(true,
"CN=WSE2QuickStartClient"));
auth.Rules.Add(new AccessCheckRule(false, "*"));
return auth.CreateServiceInputFilter(context);
}
}

After that, you must configure both assertions in your policy file, the
MutualCertificate11Assertion first, and then the CertAssertion.

Let me know if that works

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

[quoted text, click to view]

Good news! It works! :)

At the server the code is something like:

public class CertAssertion : PolicyAssertion
{ ...
public override SoapFilter
CreateServiceInputFilter(FilterCreationContext context)
{
auth = new AuthorizationAssertion();
auth.Rules.Add(new AccessCheckRule(false,
"CN=WSE2QuickStartClient"));
auth.Rules.Add(new AccessCheckRule(false, "*"));
return auth.CreateServiceInputFilter(context);
}
}

public class CustomCertPolicy : Policy
{
public CustomCertPolicy()
{
MutualCertificate11Assertion assertionCert = new
MutualCertificate11Assertion();
//Include here MutualCertificate11Assertion configuration:
ServiceX509TokenProvider, Protection,...

CertAssertion assertionAuth = new CertAssertion();

this.Assertions.Add(assertionAuth);
this.Assertions.Add(assertionCert);
}
}

Just one key: youmust add the assertions in strict order, that is, first
authorization assertion, if you add first MutualCertificate11Assertion the
same exception is throwed:

Entering SOAP filter
Microsoft.Web.Services3.Design.AuthorizationAssertion+AuthorizationFilter

Exception thrown: Identity token not found. Authorization assertion requires
identity token to be supplied by security assertion that runs prior to
authorization. at
Microsoft.Web.Services3.Design.AuthorizationAssertion.GetPrincipal(SoapEnvelope
envelope, RoleProvider roleProvider) at
Microsoft.Web.Services3.Design.AuthorizationAssertion.AuthorizationFilter.ProcessMessage(SoapEnvelope
envelope) at
Microsoft.Web.Services3.Pipeline.ProcessInputMessage(SoapEnvelope envelope)

Thanks a lot for your help!!!