WIF 是保护 iPhone 的 WCF 4.0 Restful 服务的好选择吗
我有一个项目需要向 iphone/ipad 客户端公开 WCF Restful 服务。 WCF 工作了，现在我需要使用用户名和密码来保护它。
出于某种原因，我有点不愿意使用 CustomBasicAuth
Oauth 目前在 WCF 世界中也并不理想，您必须创建包装器来解决它。 如果我错了，请纠正我。
现在，我正在研究 Windows 识别基础。 老实说，这看起来是一种聪明的方法，但缺乏文档。
有两件事必须考虑：
实施必须是 iPhone 友好。（不仅仅用于.net world)
实施需要容易 部署到云（天蓝色）
我想知道您会选择哪个选项，以及选择它的原因是什么。 任何链接或参考将不胜感激。
I have a project which needs to expose WCF restful service to iphone/ipad Client.
The WCF worked, now i need to secure it with username and password.
For some reason i am a little reluctant to go with CustomBasicAuth
Oauth is also not ideal in WCF world for now, you have to create wrapper to do work around it. please DO correct me if i am wrong.
Now, I am looking at the Windows Identification Foundation.
To be honest, that looks like a smart way but lacking of documentation.
there are 2 things have to put into consideration:
implementation have to be iPhone
friendly.(not just used in .net
world)implementation need to be easily
deployed to cloud (azure)
I would like to know which option will you choose, and what is the reason of choosing it.
any links or reference will be greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可能想尝试 WCF REST 的基本身份验证实现，http://weblogs.asp.net/cibrax/archive/2009/03/20/custom-basic-authentication-for-restful-services.aspx
根据您的要求，基本身份验证应该足以满足您的需要。 WIF 只会在混音中添加一些噪音。
谢谢
巴勃罗.
You might want to try this basic authentication implementation for WCF REST, http://weblogs.asp.net/cibrax/archive/2009/03/20/custom-basic-authentication-for-restful-services.aspx
Based on your requirements, basic authentication should be enough for what you need. WIF will only add some noise in the mix.
Thanks
Pablo.
Windows Indentity Foundation - WIF，使用 SAML 2.0 声明。
因此它非常适合跨平台和云。
以下是 WIF 文档的链接：http://msdn.microsoft.com/en-us /security/aa570351
请注意，WIF 也用于 Windows Azure 访问控制服务。
Windows Indentity Foundation - WIF, uses SAML 2.0 claims.
So it is a good fit both for cross platform and the cloud.
Here is a link to WIF documentation: http://msdn.microsoft.com/en-us/security/aa570351
Note that WIF is also used for Windows Azure Access Control Services.
我在 Azure 的自定义 STS 中为我们的一个站点使用 WIF。我认为我唯一关心的是代理（在本例中为 iPhone/iPad）是否可以处理 WIF 生成的 cookie 的大小，因为它们可能非常大。由于 cookie 大小限制，我们已经收到了大量与声明在某些浏览器中不起作用相关的异常情况。当然，我不知道您使用的平台是否存在这些限制。
I'm using WIF in a custom STS in Azure for one of our sites. I think my only concern would be whether the agent, in this case iPhone/iPad, can handle the size of the cookies that WIF generates, as they can be quite large. We've been inundated with exceptions related to the claim not working in certain browsers due to cookie size limits. Of course, I don't know if these limits exist for the platforms you're using.
查看这篇不错的代码项目文章，
http:// www.codeproject.com/Articles/149738/Basic-Authentication-on-a-WCF-REST-Service
我也在调查这个问题，所以我不确定这是完整的方法，但仍然值得一读。
我会在您的问题中添加以下架构问题：
如果您想在同一系统中支持主动（WCF）和被动（Web 浏览器身份验证），该怎么办？
我对此仍然不确定。
Check this nice code project article ,
http://www.codeproject.com/Articles/149738/Basic-Authentication-on-a-WCF-REST-Service
I am investigating this issue as well , so I am not sure this is the full approach but still worth reading.
I would add the following architectual concern to your question :
What if you want to support both active (WCF) and passive (web browser authentication) in the same system ?
I am still not sure about that.