WCF 身份验证/授权 - 需要帮助
我需要有关如何正确设置身份验证/授权的 WCF 帮助。我想尽可能多地使用开箱即用的东西来完成这项工作。
我正在设置 WCF 4.0 应用程序服务，并且我会将 4.0 Web 和 4.0 silverlight 客户端连接到同一服务。我希望客户端在服务上调用身份验证方法（它将根据数据库验证用户名/密码），然后将令牌返回给客户端。然后，客户端将存储此令牌并在每次后续服务调用时（透明地）发送它。在服务上，每次调用都会验证此令牌。另外，我需要在每次操作调用期间使用 UserID 进行一些安全检查（服务器端），因此可能需要将其包含在令牌中。
我想获得一些客户端/服务器示例来说明如何实现此目的！谢谢！
I need help with WCF on how to properly setup authentication/authorization. I would like to use as much out of the box as possible to get this done.
I am setting up a WCF 4.0 application service and I will have both 4.0 web and 4.0 silverlight clients connecting to the same service. I would like for the client to call an authentication method on the service (which will verify username/password against database) and then return a token back to the client. The client will then store this token and send it (transparently) with every subsequent service call. On the service, this token will be verified with every call. Also I will need to do some security checks (server side) during each operation call using the UserID, so that will maybe need to be included in the token.
I would like to get some client/server examples of how to accomplish this! Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我最终使用了自定义安全令牌服务。我的客户端调用 STS，进行身份验证并取回存储的令牌。然后，我使用消息检查器将令牌插入到每个传出的 wcf 服务调用中，并使用服务器端的消息检查器通过验证令牌来拦截和验证每个调用。这非常有效。
I ended up using using a custom Secure Token Service. My client calls the STS, authenticates and gets back a token which is stores. Then I used a message inspector to insert the token into every outgoing wcf service call, and used a message inspector on the server side to intercept and validate every call by verifying the token. This worked pretty well.
您可以使用 WSHttpBinding 编写自定义用户名密码验证器。这将使您能够验证用户名密码。但是，一旦身份验证发生，您就无法将数据添加到共享的令牌中。
这是一个会话绑定，这意味着客户端在服务器上有一些关联的状态。 （这不利于中间有负载均衡器的横向扩展方案，因为如果请求发送到另一台服务器，您可能必须重新建立身份验证）
http://www.pnpguidance.net/post/WCF35SecurityGuidelinesNowAvailable.aspx
授权部分是棘手的部分，因为您可以声明性地指定主体权限，也可以使用命令式选项。
http://msdn.microsoft.com/en-us/library/ff647503 .aspx#AuthorizationOptionsWCF
You can write a custom username password validator with WSHttpBinding. This will give you an ability to validate the username password. However you cannot add data to the token that is shared once the auth happens.
This is a sessionful binding which means that a client has some associated state on the server. (this is not favorable for scaled out scenario with a load balancer in between since you might have to restablish the auth if the request goes to another server)
http://www.pnpguidance.net/post/WCF35SecurityGuidelinesNowAvailable.aspx
The authorization part is the tricky part since you can either declaritively specify Principal permission or with an imperative option.
http://msdn.microsoft.com/en-us/library/ff647503.aspx#AuthorizationOptionsWCF