我正在服务之间构建一些路由功能。 原来的服务和做路由的服务有相同的配置； 两者都使用 netTcpBinding 和以下绑定配置：
netTcp绑定
安全模式=“消息”
消息 clientCredentialType="用户名"
该服务行为使用 AspNet 成员资格提供程序和我们在计算机上安装的客户端证书。
当我关闭消息安全性时，它的转发效果很好，但是当它打开时，出现以下异常：
“无法处理消息。这很可能是因为操作 'http://foo/Whatever' 不正确，或者因为消息包含无效或过期的安全上下文令牌，或者因为绑定之间不匹配*如果服务由于不活动而中止通道，则安全上下文令牌将无效。为了防止服务过早中止空闲会话，请增加服务端点绑定上的接收超时。” （强调我的）
我的想法是证书对消息进行了两次操作（一次在原始调用上，然后在中继上），这就是破坏消息的安全令牌的原因。
问题：
-
我的想法是否符合目标？
-
有没有一种方法可以继续使用消息安全性进行路由，而不需要具有令牌服务的复杂性？
有没有一种方法可以继续使用消息
I'm building some routing functionality between services. The original service and the service that does the routing have an identical configuration; both are using netTcpBinding with the following binding configuration:
netTcpBinding
security mode="Message"
message clientCredentialType="UserName"
The service behavior uses a AspNet Membership Provider and a client certificate we've installed on the machine.
When I switch off the message security it relays just fine but when it's switched on I get the following exception:
"The message could not be processed. This is most likely because the action 'http://foo/Whatever' is incorrect or because the message contains an invalid or expired security context token or because there is a mismatch between bindings*. The security context token would be invalid if the service aborted the channel due to inactivity. To prevent the service from aborting idle sessions prematurely increase the Receive timeout on the service endpoint's binding." (Emphasis mine)
My thinking is that the certificate is operating on the message twice (once on the original call and then on the relay) and this is what corrupts the message's security token.
Questions:
-
Is my thinking on target?
-
Is there a way to continue to use message security for routing without having the complexity of a token service?
发布评论
评论（1）
您提到在无安全性和消息安全性之间进行切换。 您确定要更改 WCF 服务端点以及接收端的端点吗？ 如果不是，并且两者不匹配，您将收到错误。 这就是那个错误似乎对我说的。
对于问题2，您在什么类型的环境中运行？ 您可以使用加密和签名的封闭系统，还是可能需要使用特殊密钥的公共环境？
You mentioned switching between no security and message security. Are you making sure to change both the WCF service endpoints as well as the endpoint on the receiving end? If not, and the two do not match up, you will receive an error. That's what that error seems to be saying to me.
For Question 2, what type of environment are you running in? A closed system where you could use encrypt and sign, or a public environment, where you might need to be using a special key?