如何在 ASP.NET 和 WCF 之间验证用户身份？
我们正在开发一个基于浏览器的内部网应用程序。所有用户都有活动目录帐户，因此显而易见的选择是使用集成 Windows 身份验证。但是会有多个用户访问同一台客户端计算机，因此我们决定使用基于表单的身份验证（但针对 AD 进行身份验证）。
在这种情况下，在 ASP.NET 应用程序 (IIS) 和 WCF 服务（另一台服务器 IIS 7）之间进行身份验证的最佳方法是什么。我不想使用 asp.Net 兼容模式或证书。
我正在考虑创建另一个域帐户来验证 ASP.NET 和 WCF。我还将有关当前 ASP.NET 用户的信息作为标头信息传递给 WCF。这是正确的做法吗？以下代码将从 ASP.NET 调用来访问并获取每个服务方法。
// Call WCF service from ASP.NET Application using a new domain account for each call.
proxy.ClientCredentials.Windows.ClientCredential.Domain = "mydomain";
ServiceReference.HelloWorldClient proxy = new ServiceReference.HelloWorldClient();
proxy.ClientCredentials.Windows.ClientCredential.UserName = "new_domain_account";
proxy.ClientCredentials.Windows.ClientCredential.Password = "password";
有没有更好的方法从 ASP.NET 验证 WCF？
谢谢， 灰。
We are developing a browser based intranet application. All users have active directory account, so obvious choice would be use Integrated Windows Authentication. But there will be multiple users accessing same client machine so we decided to use form based authentication (but authenticated against AD).
In this scenario what is the best way to authenticate between my ASP.NET application (IIS) and WCF Services (another server IIS 7). I don't want to use asp.Net Compatibility mode or certificate.
I am thinking to create another domain account to authenticate ASP.NET and WCF. I am also passing the information about the current ASP.NET user to WCF as header info. Is this the right way to do? The following code will call from ASP.NET to access and get each service method.
// Call WCF service from ASP.NET Application using a new domain account for each call.
proxy.ClientCredentials.Windows.ClientCredential.Domain = "mydomain";
ServiceReference.HelloWorldClient proxy = new ServiceReference.HelloWorldClient();
proxy.ClientCredentials.Windows.ClientCredential.UserName = "new_domain_account";
proxy.ClientCredentials.Windows.ClientCredential.Password = "password";
Is there any better way to authenticate WCF from ASP.NET?
Thanks,
Ash.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
向 WCF 服务验证 ASP.NET 应用程序没有什么特别的。所有正常身份验证选项均可用（用户名、X.509、Windows）。
这里有趣的是，您还想传递基于浏览器的客户端凭据。这是一种称为可信子系统的已知模式。是的，只要消息受到保护（加密），您就可以在标头中传递这些内容。
There is nothing special about authenticating an ASP.NET app to WCF service. All normal auth options are available (username, X.509, windows).
The interesting here is that you want to pass the browser-based client credentials also. This is a known pattern called a trusted sub system. And yes you can pass these in the header as long as the message is protected (encrypted).
这听起来不是 WCF 问题，而是浏览器透明身份验证的问题。
尝试在 IIS 中为 ASP.NET 应用程序禁用 Windows 集成身份验证，然后切换到基本或摘要式身份验证。这两者仍将针对 AD 进行身份验证，但浏览器不会透明地对登录用户进行身份验证。
然后在您的 ASP.NET 应用程序中，只需让它使用模拟并将 IIS 知道的任何凭据传递给您正在调用的 WCF 服务。
This sounds like it's not a WCF problem but a problem with the browser transparently authenticating.
Try disabling Windows-integrated authentication in IIS for the ASP.NET app, and switching to either Basic or Digest authentication. Both of these will still authenticate against AD, but the browser will not transparently authenticate the logged-on user.
Then in your ASP.NET app, just have it use impersonation and pass whatever credentials IIS is aware of to the WCF service that you're calling.
我根本不了解ASP.NET，但我做过一些WCF，我认为你需要做的是获取“表单登录”，然后在当前线程中模拟用户，然后启动WCF连接到另一台服务器。请参阅 msdn 上的这篇文章，快速了解一些内容这完全在 WCF 内。我不知道如何将其集成到 ASP.NET 端（就像我说的，我对该技术的了解为零），但从概念上讲，我认为这是您必须做的。
I don't know ASP.NET at ALL, but I have done WCF some, and I think what you need to do is to get the "form login" to then impersonate the user in the current thread, and then initiate the WCF connection to the other server. Take a look at this article on msdn for a quick overview of some of this purely within WCF. I don't know how you'll integrate this into the ASP.NET side (like I said, I know zero about that technology), but conceptually I think this is what you'll have to do.
嗯...如果您有 AD 并且他们使用凭据登录，那么他们在哪台计算机上并不重要，只需使用 AD 即可。如果他们使用同一台机器怎么办？
无论如何，微软在这里有很多关于这个问题的信息：
http ://wcfsecurity.codeplex.com/wikipage?title=Application%20Scenarios&referringTitle=Home
查看一下。
umm... if you have AD and they log in with their credentials it does not matter what machine they are on, just use AD. So what if they use the same machine.
In any case, microsoft has a lot of information on this issue here:
http://wcfsecurity.codeplex.com/wikipage?title=Application%20Scenarios&referringTitle=Home
Check it out.