在 2 台机器边界（3 台机器）上使用模拟时 WCF 失败

Question

这些场景各自发挥作用。当我把它们放在一起时，它就破裂了。

我有一个使用 netTCP 的 WCF 服务，它使用模拟来获取调用者 ID（在此级别将使用基于角色的安全性），

最重要的是使用 basicHTTP 和 TransportCredientialOnly 的 WCF 服务，它也使用模拟，

然后我有一个客户端前端连接到 basicHttp。

游戏的目的是从底部的 netTCP 服务返回客户端用户名 - 所以最终我可以在这里使用基于角色的安全性。

每个服务都位于不同的计算机上 - 当您在本地和远程为它们运行客户端时删除它们对其他服务进行的任何调用时，每个服务都会工作。 IE 问题仅在您跨越多个机器边界时才会出现。

IE 当我将每个部分连接在一起时，设置会中断 - 但它们自己工作得很好。

指定

我还在方法中

[OperationBehavior(Impersonation = ImpersonationOption.Required)]并将 IIS 设置为仅允许 Windows 身份验证（实际上我仍然启用了 ananymous，但禁用没有区别）

这种模拟在我有一个机器 A 上的 netTCP 服务，客户端在机器 B 上有 basicHttp 服务，机器 B 上也有 basicHttp 服务的 clinet ...但是，如果我将该客户端移动到任何机器 C，我会收到以下错误：

例外是“套接字连接被中止。这可能是由于处理消息时出错、远程主机超出接收超时或底层网络资源问题造成的。本地套接字超时为“00:10:00” 内部消息是“现有连接被远程主机强制关闭”

我开始认为这更多是一个网络问题而不是配置问题...但后来我抓住了救命稻草...

配置文件如下（从客户端向下到netTCP层）

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="basicHttpBindingEndpoint" closeTimeout="00:02:00"
                    openTimeout="00:02:00" receiveTimeout="00:10:00" sendTimeout="00:02:00"
                    allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                    maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                    messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                    useDefaultWebProxy="true">
                    <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                        maxBytesPerRead="4096" maxNameTableCharCount="16384" />
                    <security mode="TransportCredentialOnly">
                        <transport clientCredentialType="Windows" proxyCredentialType="None"
                            realm="" />
                        <message clientCredentialType="UserName" algorithmSuite="Default" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <client>
            <endpoint address="http://panrelease01/WCFTopWindowsTest/Service1.svc"
                binding="basicHttpBinding" bindingConfiguration="basicHttpBindingEndpoint"
                contract="ServiceReference1.IService1" name="basicHttpBindingEndpoint" 
 behaviorConfiguration="ImpersonationBehaviour" />
        </client>
  <behaviors>
   <endpointBehaviors>
    <behavior name="ImpersonationBehaviour">
     <clientCredentials>
      <windows allowedImpersonationLevel="Impersonation"/>
     </clientCredentials>
    </behavior>
   </endpointBehaviors>
  </behaviors>
    </system.serviceModel>
</configuration>

客户端的服务（basicHttp服务和netTCP服务的客户端）

<?xml version="1.0" encoding="UTF-8"?>
<configuration>

  <system.web>
    <compilation debug="true" targetFramework="4.0" />
  </system.web>
  <system.serviceModel>
    <bindings>
      <netTcpBinding>
        <binding name="netTcpBindingEndpoint" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
          transactionFlow="false" transferMode="Buffered" transactionProtocol="OleTransactions"
          hostNameComparisonMode="StrongWildcard" listenBacklog="10" maxBufferPoolSize="524288"
          maxBufferSize="65536" maxConnections="10" maxReceivedMessageSize="65536">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00"
            enabled="false" />
          <security mode="Transport">
            <transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
            <message clientCredentialType="Windows" />
          </security>
        </binding>
      </netTcpBinding>
  <basicHttpBinding>
   <binding name="basicHttpWindows">
    <security mode="TransportCredentialOnly">
     <transport clientCredentialType="Windows"></transport>
    </security>
   </binding>
  </basicHttpBinding>
    </bindings>
    <client>
      <endpoint address="net.tcp://5d2x23j.panint.com/netTCPwindows/Service1.svc"
    binding="netTcpBinding" 
    bindingConfiguration="netTcpBindingEndpoint"
    contract="ServiceReference1.IService1" 
    name="netTcpBindingEndpoint"
    behaviorConfiguration="ImpersonationBehaviour">
        <identity>
          <dns value="localhost" />
        </identity>
      </endpoint>
    </client>
    <behaviors>
  <endpointBehaviors>
   <behavior name="ImpersonationBehaviour">
    <clientCredentials>
     <windows allowedImpersonationLevel="Impersonation" allowNtlm="true"/>
    </clientCredentials>
   </behavior>
  </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="WCFTopWindowsTest.basicHttpWindowsBehaviour">
          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
   <services>
    <service name="WCFTopWindowsTest.Service1"
       behaviorConfiguration="WCFTopWindowsTest.basicHttpWindowsBehaviour">
     <endpoint address=""
      binding="basicHttpBinding"
      bindingConfiguration="basicHttpWindows"
      name ="basicHttpBindingEndpoint"
      contract ="WCFTopWindowsTest.IService1">

     </endpoint>      
   </service>       
   </services>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
 <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
        <directoryBrowse enabled="true" />
  </system.webServer>

</configuration>

然后最后是netTCP层的服务

<?xml version="1.0" encoding="UTF-8"?>
<configuration>

  <system.web>
   <authentication mode="Windows"></authentication>
   <authorization>
    <allow roles="*"/>
   </authorization>
    <compilation debug="true" targetFramework="4.0" />
        <identity impersonate="true" />
  </system.web>
  <system.serviceModel>
   <bindings>
    <netTcpBinding>
     <binding name="netTCPwindows">
      <security mode="Transport">
       <transport clientCredentialType="Windows"></transport>
      </security>
     </binding>
    </netTcpBinding>
   </bindings>
   <services>
    <service behaviorConfiguration="netTCPwindows.netTCPwindowsBehaviour" name="netTCPwindows.Service1">
     <endpoint address="" bindingConfiguration="netTCPwindows" binding="netTcpBinding" name="netTcpBindingEndpoint" contract="netTCPwindows.IService1">
      <identity>
       <dns value="localhost" />
      </identity>
     </endpoint>  
     <endpoint address="mextcp" binding="mexTcpBinding" contract="IMetadataExchange"/>
     <host>
      <baseAddresses>     
       <add baseAddress="net.tcp://localhost:8721/test2" />
      </baseAddresses>
     </host>
    </service>       
   </services>   
    <behaviors>  
      <serviceBehaviors>
        <behavior name="netTCPwindows.netTCPwindowsBehaviour">  

          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="false" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
 <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
        <directoryBrowse enabled="true" />
  </system.webServer>

</configuration>

Answer 1

如果您需要进行不止一跳，则需要为此启用委派。您可以在此处获取更多信息。

话虽这么说，如果您需要做的只是确定调用后端服务 (netTcp) 的用户的角色，则不一定需要模拟，因为 WindowsIdentity 的 TokenImpersonationLevel 只需要为信息即可确定角色会员资格。在这种情况下，您只需确保模拟发生在中间层 (basicHttp)。