我正在开发一个应用程序，它允许从 Windows Phone 应用程序和 MVC 3 Web 界面输入和显示数据。电话客户端的数据访问是通过 MVC 3 应用程序中托管的经过身份验证的 WCF 服务进行的。用户将跟踪他们独有的信息，因此该服务只会向我显示我输入的数据。
在这种情况下处理身份的最简单方法是什么？我想过使用 Windows Live ID，因为 电话应用程序可以访问到 Windows Live 匿名 ID 属性。然而，据我所知，没有办法允许基于 Web 的 Windows Live 登录，从而为我提供相同的 Windows Live 匿名 ID - Windows Live Messenger Connect 登录为我提供了一个特定于站点的唯一 ID，该 ID 与电话客户端的匿名 ID 不同。
或者，我可以通过 Facebook SDK 在客户端和手机上使用 Facebook 身份验证。我关心的是服务呼叫的安全。我认为设备第一次使用 Facebook ID 连接服务时，服务器会向其颁发密钥，并且服务访问需要 Facebook ID 和服务器颁发的密钥。
对以上内容有什么想法吗？我缺少一个更简单的解决方案吗？
I'm working on an application which allows data entry and display from both a Windows Phone application and an MVC 3 web interface. Data access for the phone client is via authenticated WCF services hosted in the MVC 3 application. Users will be tracking information which is unique to them, so the service will only show me data which I have entered.
What is the simplest way to handle identity in this scenario? I'd thought of using Windows Live ID, since the phone application has access to a Windows Live Anonymous ID property. However, from what I can tell there's no way to get allow for a web-based Windows Live sign-in which gives me the same Windows Live Anonymous ID - Windows Live Messenger Connect login gives me a site-specific unique ID, which would be different from the phone client's Anonymous ID.
Alternatively, I could use Facebook authentication on both client and phone with Facebook SDK. My concern there is in securing the service calls. I'm thinking that the first time a device connects with the service with a Facebook ID, the server issues it a key, and both the Facebook ID and the server issued key are required for service access.
Thoughts on the above? Is there a simpler solution that I'm missing?
发布评论
评论（3）
亲爱的乔恩，
我没有 WP 开发经验，但我对 WCF Auth 进行了一些搜索。最近几天，发现 apiKey 身份验证对我来说几乎是最好的方法。 Rob Jacobs 在本文中解释了它的工作原理；
http://blogs.msdn.com/b/rjacobs/archive/2010/06/14/how-to-do-api-key-verification-for-rest-services-in -net-4.aspx
Dear Jon,
I have no experience on WP development but I have made a a little search for WCF Auth. for couple of days recently and found out that the apiKey auth is nearly the best way to me. Rob Jacobs has explained how it works on this article;
http://blogs.msdn.com/b/rjacobs/archive/2010/06/14/how-to-do-api-key-verification-for-rest-services-in-net-4.aspx
API 密钥的替代方案是使用基于声明的身份和安全令牌。您可以使用 Windows Azure 访问控制服务作为安全令牌的可信颁发者，其附加值是它预先配置为使用 LiveID、Facebook、Google、任何 OpenID 和任何 WS-Federation 身份提供商。网站和 Web 服务都会信任 ACS。
ACS 将为您提供网站的 SAML 令牌（允许您的用户使用 LiveID、Google 或 FB 登录）。
ACS 还可以颁发简单 Web 令牌 (SWT)，这对于 REST 服务尤其有用（假设电话客户端使用它）。
您无法在应用程序中使用与手机关联的 LiveID，但您仍然可以使用 LiveID（或任何其他身份提供商）。这是 如何执行此操作的示例。它使用在手机应用程序中嵌入网络浏览器的常见方法，并用于所有安全令牌协商。
使用 ACS 为您提供了很大的灵活性，但又没有那么复杂。让网站具有“声明意识”并信任 ACS 非常简单。更多示例：http://claimsid.codeplex.com
An alternative to an API Key is to use claims based identity and security tokens. You could use the Windows Azure Access Control Service as a trusted issuer of security tokens, with the value add that it comes pre-configured to use LiveID, Facebook, Google, any OpenID and any WS-Federation identity provider. Both the web site and the web service would trust ACS.
ACS will give you SAML tokens for the web site (allowing your users to login to it with LiveID, Google or FB).
ACS can also issue Simple Web Tokens (SWT), which are especially neat for REST services (assuming the phone client uses that).
You can't use the LiveID associated with the phone in your app, but you can still use LiveID (or any other identity provider). This is an example of how to do it. It uses the common approach of embedding a web browser in the phone app and use to for all security token negotiation.
Using ACS gives you a lot of flexibility without all the complextity. Making a web site "claims aware" and trust ACS is very straight forward. More samples here: http://claimsid.codeplex.com
如果您需要将电话链接到 MVC 站点上的用户，您可以执行以下操作 Netflix 和 亚马逊为 Roku 和其他设备提供服务，并有某种激活过程。为了使其更容易，您可以使用 QR 码或 MVC 站点生成的其他类型的条形码，让用户为其拍照，并使用 Silverlight ZXing 条码扫描库。可能有点复杂，但它适用于所有机顶盒。
If you need to link the Phone to a user on the MVC site you could do what Netflix and Amazon do for Roku and other devices and have some sort of an activation process. To make it easier you could use a QR Code or some other type of barcode generated by the MVC site, have the user take a picture of it, and process the image using the Silverlight ZXing Barcode Scanning Library. Probably a bit convoluted, but it works for all the set top boxes.