netTcpBinding 最快的安全配置是什么？
我正在运行一个 WCF 服务，除其他外，该服务用作网站的后端。因为网站和 WCF 服务都在同一台计算机上运行，并且出于性能考虑，我使用 netTcpBinding 对其进行设置。
现在的问题是，因为它们存在于同一个盒子上，所以我真的不关心传输级安全性或消息级加密；消息被拦截的唯一可能方法是有人进入网络服务器本身，如果他们这样做，我已经遇到了更大的问题。
所以我的问题是：当客户端和服务器已经位于受信任的子系统上时，可以使用什么配置来确保 netTcpBinding 尽可能快？
当然，答案可能是使用“无”安全性。但在我的特殊情况下，我仍然需要对自定义数据库使用用户名身份验证。是否可以将其配置为仍然使用用户名身份验证，但不关心证书或保护端点之间的数据？或者我是否需要使用自定义 SOAP 标头来实现自定义行为来存储用户名/密码，然后我真的可以将安全性设置为“无”？
服务器配置
<netTcpBinding>
<binding name="Net_Tcp_Binding">
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
</binding>
</netTcpBinding>
它使用自定义用户名身份验证 - 基本上每个调用都会进行身份验证针对自定义数据库进行授权。服务端也使用证书与客户端进行协商，例如：
<serviceBehaviors>
<behavior name="MyBehavior">
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceAuthorization principalPermissionMode="Custom">
<authorizationPolicies>
<add policyType="MyAssembly.CustomAuthorizationPolicy,MyAssembly" />
</authorizationPolicies>
</serviceAuthorization>
<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyAssembly.CustomCredentialValidator,MyAssembly" />
<serviceCertificate x509FindType="FindBySubjectName" findValue="CN=servercert" storeLocation="LocalMachine" storeName="My" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
Client Config
<netTcpBinding>
<binding name="Net_Tcp_Endpoint">
<reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
</binding>
</netTcpBinding>
I'm running a WCF service that, among other things, is used as the back end for a web site. Because both the web site and the WCF service are running on the same machine, and in the interests of performance, I set it up with a netTcpBinding.
Now the thing is, because they exist on the same box, I really don't care about either transport-level security or message-level encryption; the only possible way the messages could be intercepted is if someone gets into the web server itself, and if they do that I've got bigger problems already.
So my question is: when the client and server are already on a trusted subsystem, what configuration can be used to ensure the netTcpBinding is as fast as possible?
Of course the answer might be to use security of "none". But in my particular case I still need to use UserName authentication against a custom database. Can it be configured so that it still uses UserName authentication, but doesn't bother with certificates or securing the data between the endpoints? Or do I perhaps need to implement a custom behaviour with a custom SOAP header to store the username/password, and then I really can set security to "none"?
Server Config
<netTcpBinding>
<binding name="Net_Tcp_Binding">
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
</binding>
</netTcpBinding>
It uses custom UserName authentication - basically every call authenticates & authorises against a custom database. The service side also uses a certificate to negotiate with its clients, e.g:
<serviceBehaviors>
<behavior name="MyBehavior">
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceAuthorization principalPermissionMode="Custom">
<authorizationPolicies>
<add policyType="MyAssembly.CustomAuthorizationPolicy,MyAssembly" />
</authorizationPolicies>
</serviceAuthorization>
<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyAssembly.CustomCredentialValidator,MyAssembly" />
<serviceCertificate x509FindType="FindBySubjectName" findValue="CN=servercert" storeLocation="LocalMachine" storeName="My" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
Client Config
<netTcpBinding>
<binding name="Net_Tcp_Endpoint">
<reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
</binding>
</netTcpBinding>
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
“无”是最快的，是的:-)
另一方面，如果您的服务和后端在同一台计算机上运行，您还应该认真查看 netNamedPipe 绑定，如果您有“on”，那么这绝对是最佳选择机”通讯。它比 netTcp 更快、更高效。
为了针对服务对调用者进行身份验证，您需要使用某种安全方法 - 因为 netNamedPipe 仅支持“none”或“Windows”，所以我会选择 Windows。如果不使用，则无法识别（验证）调用者，因此无法根据调用者的身份进行授权（谁可以做什么）。
一旦您对呼叫者（呼叫我的人）进行了身份验证，您就可以使用 Windows 组或内置 ASP.NET 成员资格/角色提供者子系统来进行基于角色的授权，以确保谁可以执行此操作什么操作。这可以使用服务配置的行为部分中名为
马克
"None" would be fastest, yes :-)
On the other hand, if your service and backend are running on the same machine, you should also have a serious look at the netNamedPipe binding, which is the absolute optimum if you have "on machine" communication. It's even faster and more efficient than netTcp.
In order to authenticate the caller against the service, you would need to use some method of security - since netNamedPipe only support "none" or "Windows", I'd pick Windows. If you use none, you have no way of identifying (authenticating) the caller, and thus, you cannot have authorization (who can do what) based on the caller's identity.
Once you've authenticated the caller (who is calling me), then you can use either Windows groups or the built-in ASP.NET membership/role-provider subsystem to do role-based authorization, in order to make sure who can do what operations. This can be configured using a service behavior called
<serviceAuthoritzation>in your behavior section of the service's config.Marc