Lesson 1: Authentication in Visual C#.NET

Generating Data Matrix in Visual C#.NET Lesson 1: Authentication

Table 8-3

Description Searches for the certificate that matches the thumbprint specified in the findValue attribute. Searches for the certificate that matches the subject name specified in the findValue attribute. It is possible that using this type of search will return more than one certificate. The search is case-insensitive and looks for any subject that contains the indicated value.

FindBySubjectDistinguishedName Searches for the certificate that matches the subject name specified in the findValue attribute. The difference between this search type and FindBySubjectName is that the specified value must match the distinguished name precisely. FindByIssuerName Searches for the certificate that matches the issuer name specified in the findValue attribute. It is possible that using this type of search will return more than one certificate. The search is case-insensitive and looks for any issuer name that contains the indicated value. Searches for the certificate that matches the issuer name specified in the findValue attribute. The difference between this search type and FindByIssuerName is that the specified value must match the distinguished name precisely. Searches for the certificate that matches the serial number specified in the findValue attribute. The serial number must be in reverse order because it is an integer. The reason for needing to reverse the value is because the serial number is stored with the least significant byte first. However, if the serial number is specified as an integer, the least significant byte is last, so to find the desired serial number by using an integer, you need to reverse the bytes that appear in the serial number. Searches for certificates that are valid as of the DateTime value specified in the findValue attribute. Searches for certificates that are not yet valid as of the DateTime value specified in the findValue attribute. Searches for certificates that have expired as of the DateTime value specified in the findValue attribute. Searches for certificates in which the template name matches the name provided in the findValue attribute. A template name is an X509 v3 extension that specifies the uses of the certificate.

8

Table 8-3

Description Searches for the certificate in which the findValue attribute matches either the application policy friendly name or the object identifier of the certificate. Searches for the certificate in which the findValue attribute matches either the friendly name or the object identifier of the certificate policy. Searches for the certificate in which the findValue attribute matches a string describing the certificate s extension. Searches for the certificate in which the findValue attribute matches either a string representing the key usage or an integer representing a bit mask containing all the requested key usages. Searches for the certificate in which the findValue attribute matches the string representing the subject key identifier in hexadecimal.

As a result of the way the search types are defined, the FindByTimeValue, FindByTimeNotYetValid, and FindByTimeExpired types should each contain a unique set of certificates. When these sets are merged, the combination should include all the certificates in the store being searched.

In the specific example from the Issued Token Credentials section, the identity element is configured to request a SAMLToken from CardSpace. This fact is not immediately obvious from merely examining the configuration file. However, notice that the binding is set to use an issued token to secure the message, and the certificate that is referenced by the certificateReference element was provided by CardSpace. The fact that CardSpace was the source of the certificate is not visibly apparent. In addition, the same certificate information is provided in the serviceCredentials element in the service behavior. As you will see shortly, the same certificate information is used in the client configuration.