我应该如何使用 OpenID 从 Windows Phone 7 应用程序对 WCF 数据服务进行身份验证？
我有一个 Windows Phone 应用程序，它正在从托管在 ASP.NET MVC 3 应用程序中的 WCF 数据服务服务读取和写入数据。
我可以根据需要配置客户端和服务器。如果可行的话，我想使用 OpenID，一旦用户在手机上进行身份验证，他们应该能够浏览与其 OpenID 关联的数据。
我应该如何配置客户端和服务器才能使其工作？
I have a Windows Phone application which is reading and writing data from a WCF Data Services service which is hosted in and ASP.NET MVC 3 application.
I can configure both client and server as necessary. I'd like to use OpenID if practical, and once a user is authenticated on the phone they should be able to browse through data which is associated with their OpenID.
How should I configure client and server to make that work?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
要在应用程序中使用 OpenID，您应该考虑使用连接到提供商站点（或可以重定向的站点）的嵌入式 WebBrowser 控件。当 OpenID 提供商返回您的站点（嵌入在浏览器控件中）时，您会将必要的标识符传递回应用程序。
有一个使用 Twitter 应用程序（使用 OAuth）执行此操作的示例，位于 http://blog.markarteaga.com/ OAuthWithSilverlightForWindowsPhone7.aspx
To use OpenID in your app you should look at using an embedded WebBrowser control which connects to the provider site (or your site which can redirect). When the OpenID provider returns to your site (embedded in the browser control) you'd pass necessary identifiers back to the app.
There's an example of doing this with a twitter app (using OAuth) at http://blog.markarteaga.com/OAuthWithSilverlightForWindowsPhone7.aspx
OpenID 是一个尴尬的选择。听起来用户已经拥有与其帐户关联的数据，这意味着用户必须在某个时间点登录服务器来设置此数据，然后使用相同的凭据登录应用程序才能访问此数据。问题在于安全地验证客户端应用程序确实已经对相关用户进行了身份验证。假设客户端应用程序（以某种方式）拥有用户的 OpenID 是不够的，因为服务器不能隐式信任客户端应用程序告诉它的内容。
我突然想到，OpenID 可以做的事情如下。
首先，在服务器上设置 OpenID 身份验证。然后，当客户端应用程序需要进行身份验证时，它应该使用 WebBrowser 控件指向服务器 URL，该服务器 URL 反过来又允许用户使用其 OpenID 提供程序进行身份验证，并将浏览器指向带有身份验证信息的服务器。此时，客户端应用程序不知道用户的身份验证状态，但服务器知道他们是谁。现在，服务器可以生成一次性身份验证密钥供客户端使用。它可以重定向到其中包含该密钥的特殊 URL，此时客户端会检测到该 URL，提取密钥，隐藏 WebBrowser 控件，并使用该密钥与服务器通信。我相信这将是进行此类身份验证的安全方法，但正如我所说，这只是我的想法。
OpenID is an awkward choice. It sounds like the user already has data associated with their account, which means that the user would have to login to the server at some point in time to set up this data, and then login to the app with the same credentials to access this data. The issue is that of securely verifying that the client app has indeed authenticated the user in question. Assuming that the client app (somehow) has the user's OpenID is not enough because the server can't implicitly trust what the client app tells it.
Off the top of my head, I'd say, what could be done with OpenID is as follows.
First, set up OpenID authentication on the server. Then, when the client app needs to authenticate, it should use the WebBrowser control to point to a server URL that, in turn, lets the user authenticate with their OpenID provider, and points the browser back to the server with the authentication info. At this point, the client app is unaware of the user's authentication status, but the server knows who they are. Now, the server can generate a single-use auth key for the client to use. It can redirect to a special URL with that key in it, at which point the client detects said URL, extracts the key, hides the WebBrowser control, and uses that key to talk to the server. I believe that would be a secure way to do such authentication, but like I said, this is just off the top of my head.