WCF 数据服务身份验证

Question

- 是否可以使用基于证书的身份验证来保护 WCF 数据服务的安全？

- 是否有描述此过程的资源？

- 我们可以将消息安全性与 WCF 数据服务结合使用吗？

Answer 1

您所有问题的答案都是“是”。下面是 Microsoft 模式和实践团队提供的信息非常丰富的链接，可准确完成您正在寻找的任务。

http://msdn.microsoft.com/en-us/library/cc949005.aspx

Answer 2

基于证书的身份验证可以这样完成：

服务器端：

public class ODataService : DataService<Database>
    {
        public ODataService()
        {
            ProcessingPipeline.ProcessingRequest += ProcessingPipeline_ProcessingRequest;
        }

        void ProcessingPipeline_ProcessingRequest(object sender, DataServiceProcessingPipelineEventArgs e)
        {
            if (!HttpContext.Current.Request.ClientCertificate.IsPresent)
            {
                throw new DataServiceException(401, "401 Unauthorized");
            }

            var cert = new X509Certificate2(HttpContext.Current.Request.ClientCertificate.Certificate);
            if (!ValidateCertificate(cert))
            {
                throw new DataServiceException(401, "401 Unauthorized");
            }

            var identity = new GenericIdentity(cert.Subject, "ClientCertificate");
            var principal = new GenericPrincipal(identity, null);
            Thread.CurrentPrincipal = principal;
            HttpContext.Current.User = principal;
        }

        private bool ValidateCertificate(X509Certificate2 cert)
        {
            // do some validation
        }

客户端：

为数据库服务引用创建一个分部类 (DataServiceContext)

public partial class Database
{
    // ref: http://social.msdn.microsoft.com/Forums/en-US/0aa2a875-fd59-4f3e-a459-9f604b374749/how-do-i-use-certificate-based-authentication-with-data-services-client?forum=adodotnetdataservices
    private X509Certificate clientCertificate = null;
    public X509Certificate ClientCertificate
    {
        get
        {
            return clientCertificate;
        }
        set
        {
            if (value == null)
            {
                // if the event has been hooked up before, we should remove it
                if (clientCertificate != null)
                {
                    SendingRequest -= OnSendingRequest_AddCertificate;
                }
            }
            else
            {
                // hook up the event if its being set to something non-null
                if (clientCertificate == null)
                {
                   SendingRequest += OnSendingRequest_AddCertificate;
                }
            }

            clientCertificate = value;
        }
    }

    private void OnSendingRequest_AddCertificate(object sender, SendingRequestEventArgs args)
    {
        if (null != ClientCertificate)
        {
            (args.Request as HttpWebRequest).ClientCertificates.Add(ClientCertificate);
        }
    }

像这样使用

        Database db = new Database(new Uri(service));
        db.ClientCertificate = CertificateUtil.GetCertificateByThumbprint(StoreName.My,
                                                                          StoreLocation.LocalMachine,
                                                                          "<a thumbprint>");

私钥存储在客户端计算机上，公钥存储在本地计算机/受信任根 CA 的服务器上

请记住在 IIS 中要求/协商此站点的客户端证书。

（在 WCF 数据服务 5.2、VS 2012 上测试）