使用 NetTcpBinding 在 WCF 中进行 Windows 身份验证/加密
我试图了解 Windows 身份验证/加密如何与 WCF 中的 NetTcpBinding 配合使用。我需要确切地知道使用什么加密算法来加密通过网络传输的数据（以及一些文档来证明这一点）。如果客户端和/或主机不在域中，Windows 身份验证/加密是否仍然有效？
I'm trying to understand how windows authentication / encryption works with the NetTcpBinding in WCF. I need to know exactly what encryption algorithm is used to encrypt the data going across the wire (and some documentation to prove it). Will windows authentication / encryption still work if the client and or host is not on a domain?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
使用 Windows 凭据的 netTcpBinding 要求调用者和服务位于同一域中 - 或者至少位于相互信任的域中。否则，服务器将无法验证 Windows 凭据并拒绝服务调用。
至于加密：您甚至可以选择您想要的加密方式！ :-) TripleDES、AES - 你能想到的，也有不同的密钥长度。
请参阅 WCF 安全基础知识 文章 - 它讨论了安全和加密的各个方面；另请参阅有关保护服务的 MSDN 文档，其中有更多详细信息；可以在此处找到一个很好的概述，其中显示了basicHttp 传输安全元素的属性。
The netTcpBinding using Windows Credentials requires the caller and the service to be on the same domain - or at least on mutually trusting domains. Otherwise, the server won't be able to verify the Windows credentials and will refuse the service call.
As for encryption : you can even pick and choose which one you'd like ! :-) TripleDES, AES - you name it, with varying key lengths, too.
See the Fundamentals of WCF Security article - it talks about all aspects of security and encryption; also see the MSDN Docs on Securing Services which goes into some more detail; a good overview can be found here showing the properties of the basicHttp transport security element.
去年，我必须使用 wcf 实现一个分布式系统，这需要一种跨系统所有层既安全又高性能的机制。我们决定通过创建二进制加密令牌来创建我们自己的安全架构。加密的令牌包含给定用户拥有的所有权限。
例如，用户登录系统，如果成功通过身份验证，它将收到加密的令牌。该令牌存储在本地 Web 客户端上。用户的所有进一步请求都将包含该令牌。该令牌用于架构的多个级别。 Web 服务器将使用它来决定启用或禁用哪些视觉元素。由于服务层暴露在互联网上，每个打开的门都会检查令牌进行身份验证，并检查该令牌是否具有执行给定任务的适当权限。业务层可以再次检查令牌中包含的更具体的权限。
优点：
我知道它可能无法回答您的具体问题，但当您仍在决定时，它可能会给您一些思考的机会系统的层内架构。
Last year I had to implement a distributed system using wcf that required a mechanism both safe and performant across all layers of the system. We decided for creating our own security architecture by creating a binary encrypted token. The encrypted token contained all permissions a given user had.
So for example a user would log in into the system and if successfully authenticated it would receive an encrypted token back. This token was stored locally on the web client. All further requests by the user would contain that token. The token was used in several levels of the architecture. The web server would use it to decide what visual elements to enable or disable. Since the service layer was exposed to the internet, each open door would check the token for authentication and check if that token had the proper permission to execute a given task. The business layer could check again for a more specific right included in the token.
The advantages:
I know it probably doesn't answer your specific questions, but it will maybe give you some for food for thought while you're still deciding on the intra-layer architecture of your system.