Securing BizTalk WCF Services

Introduction

Securing BizTalk WCF Receive Locations.

                 I would like to create a BizTalk WCF Receive Location, that utilizes SSL and requires that clients use a certificate for authentication. I also want to authorize the access to certain client certificates; so that not every client that uses a certificate issued by a trusted issuer, has access to the service.

Steps Involved:

      These steps would be targeted towards BizTalk Server 2013R2 / IIS 8.5

1. Publish schema as a WCF Service. 
2. Create a self-signed certificate on the machine hosting the service (This is your server certificate).
3. Configure site to use SSL.
4. Test the https URL. -- With this step your service is configured to use SSL. If you want to use windows authentication instead of client certificate authentication to authenticate and authorize access, go to step 11. 
5. Configure the service to use Client certificate authentication.
6. Create and install a root Certificate authority. 
7. Create, export client certificate and configure client.
8. Test https url using client cert. 
9. Configure authorization; configure IIS Mapping and URL Authorization. 
10. Test with different client certificates. 
11. Configuring windows authentication instead of Client certificate authentication.

• Using Visual studio, publish your schema as a WCF Service.
  • Enable Metadata exchange.
  • Create BizTalk Receive location.
  • Enable Anonymous access.  
  • Publish

     

• In IIS create a new Application pool.   Change the identity of app pool to use an account that has access to BizTalk. 
• Change the WCF service's app pool in IIS to the one created in the previous step. 
• Enable the receive location and make sure the service is working.

• Open Internet Information Services Manager.
• Click on the server name in the connections column on the left and double click on the server certificates.

     

• In the Actions Panel click on Create Self-Signed certificate. 
• Provide the details as in the below screenshot.
• Click OK and you can see your certificate in the Server certificate panel. The Server certificate that we want to bind to our service is ready.<o:p>

     

Step 3: Configure site to use SSL.

 

 

• In IIS, Click on the Website your service is published to (Default website in my case).
• Click on Bindings in the Actions Panel.
• Click on 'Add' in the Site Bindings pop up.
• In the 'Add Site Binding' pop up, select https in Type drop down. Select the certificate created in previous step in the SSL Certificate drop down.
• Click OK.

     

 

• Click on your service/App under default website, double click on SSL Settings.
• Check the Require SSL check box. Choose Ignore radio button in the client certificates and click on apply in the Actions panel.

     

 

• Go to BizTalk Admin console and open the WCF Receive location created in the step 1.
• Click on Configure, go to security Tab, choose Transport from the Security mode drop down, leave the transport security credential to none and click OK.

     

 

• Back in the IIS; go to your application's virtual directory and open the Web.config file.
• In the behavior tag, change httpsHelpPageEnabled and httpsGetEnabled to true.
• Restart your website.

With this step your WCF Service is configured to use SSL. We will now test and then configure Client certificate authentication.

 

 

 

Step 4: Test the https url. <o:p>

 

 Browse the service in internet explorer using https. https://localhost/TestSSLService/testsslservice.svc

 

Note : Use full name of your machine instead of localhost in the url. Using localhost in url raises this error -- <o:p>

 

The security certificate for host <<full name of  your machine>> does not match the name of the page you are viewing. In IIS server certificates, Check the "Issued To" part of the certificate you created in Step2. That should match full name of your machine. <o:p>

 

 

Step 5: Configure the service to use Client certificate authentication. <o:p>

 

 

• Go to IIS, Click on your service/App under default website, double click on SSL Settings. 
• Under Client certificates click Require and click on apply in the Actions panel.  
• Anonymous Authentication must be enabled.

     

 

• Go to BizTalk admin console; in the WCF Receive location adapter settings, security tab, Change the transport client credential type to 'Certificate'.
• With this step the WCF Service is configured to use Client certificate authentication. But any client certificate issued by a trusted issuer can be used to access this service, provided the issuers root certificate is installed in your machine's "Trusted Root Certification Authorities".
• In the next steps we will setup authorization.

 

  Step 6,7 & 8:  Create client certificate and test the service.

 

 

• Go to Control Panel, programs and features. Click 'Turn Windows Features on or off'.
• In the windows features pop up, navigate to Internet information services, world wide web services, Security.
• Check if features 'IIS Client Certificate mapping Authentication' and 'URL Authorization' are checked. If not, check them and click OK to install these features. 

     

 

• Go to IIS, click on the website your service is published to (default web site) . 
• Double click configuration editor.

     

 

 

• In the Configuration editor,  Section drop down select 'IIS Client Certificate Mapping Authentication' under System.Webserver/security/authentication.
• Set the enabled flag to True.
• Click the ellipsis of manyToOneMappings field.

• Click on Add in the Collection Editor window.
• Enter values for description and name. Fill the UserName and password fields, use an account that has access to that machine.  Providing wrong password in this box will give an authentication denied error when you call the service.
• Click on ellipsis in the rules field.

     

 

• In the popup window, click Add and enter the values as in below pic. matchCriteria is the CN value that you provided while creating the client certificate in step 6. Close these two windows and click Apply on the Configuration editor window.

     

 

• With this step you have mapped the client certificate you created in step 6 to a windows account. You can still call the service with any client certificate. If you use the mapped certificate the call will be authenticated. If you use a different client certificate the call will be anonymous.
• Next we authorize access to the account you just used in the previous step, so that the service cannot be called with any other certificate.
• Select your WCF Service in IIS and double click on 'Authorization rules'.

     

 

• Edit the existing rule and choose Specified users. Provide the account you used in the previous step and click OK.
• Last and Important step. Go to your Application pool in IIS and change the managed pipeline mode to classic.

     

 

     

 

• In BizTalk Admin console, go to adapter configuration, Security tab and update Transport client credential type to Windows.
• Last and Important step. Go to your Application pool in IIS and change the managed pipeline mode to classic.
• Restart your website and test.