Certificate based Authentication and WCF (Mode independent)
My third approach for restricting trust when using client
certificates works for transport and message security.
Furthermore it does not involve any OS level configuration.  WCF
has a piece of plumbing called the Service Authorization
Manager. The SAM gets called on every incoming request and at
this point the claim sets are already populated. In the issuer
claim set of the client, you can find the thumbprint of the
issuing CA (you can also find the thumbprint of the end
certificate of course).  With that information you can apply the
same logic as in the certificate validator I showed earlier.
Writing a SAM involves deriving from a class called
ServiceAuthorizationManager and implementing the CheckAccessCore
method. The logic looks like this:  protected override bool
CheckAccessCore(OperationContext operationContext)     string[]
trustedThumbprints = GetTrustedThumbprints();     string[]
thumbprints;      if (ValidationMode == ValidationMode.EndCe