如何处理WCF服务中的密码过期问题
我有一个具有经典架构的应用程序： UI <--> WCF<-->;业务层<-->数据层<-->数据库。对于 WCF 服务，我使用用户名/密码身份验证。这些用户名和密码存储在应用程序数据库中。密码配置为定期过期（业务要求）。
我遇到密码过期的问题。我在我的WCF服务中做了一个负责修改用户密码的操作，但是当密码过期时我无法访问它，因为身份验证失败！
我该怎么处理？我是否应该创建一个具有特殊身份验证的特殊端点以进行密码修改（例如，如果密码正确，则允许访问，尽管已过期）？对于这样一个“小”问题来说，这听起来像是一个沉重的解决方案。
编辑：也许我应该添加更多上下文。 验证是在实现 UserNamePasswordValidator 的类中进行的。在验证方法中，我检查用户是否被锁定、密码是否不正确、是否已达到最大登录尝试次数（如果是这样，我也会锁定用户）以及密码是否已过期。如果其中之一为真，则身份验证失败。 也许这不是最好的设计...
I have an application with a classic architecture: UI <--> WCF <--> Business layer <--> Data Layer <--> Database. For the WCF service, I use username/password authentication. These usernames are passwords are stored in the application database. The password are configured to expire regularly (business requirement).
I have a problem with password expiration. I have made an operation in my WCF service that is responsible for modifying the user password, but I cannot access it when the password has expired because the authentication failed!
How should I handle that? Should I create a special endpoint with special authentication for password modification (like tolerating access if the password is correct eben though it expired)? It sounds like a heavy solution for such a "small" problem.
EDIT: maybe I should add some more context.
The validation is made in a class implementing UserNamePasswordValidator. In the validate method, I check if the user is locked, if the password is incorrect, if the maximum of login attempts has been reached (if so I also lock the user) and if the password has expired. If one of these is true, the authentication fails.
Maybe it is not the best design...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
每当验证密码时，首先检查密码是否过期。如果密码过期为 true ，则向客户端发送带有特定错误代码/错误消息的异常，表明密码已过期。在客户端检查服务响应中是否有此类错误代码，并将用户重定向到更改密码页面。
whenever the password is validated , initially check for password expiry. If password expiry is true , send an exception with a specific error code/error message to the client saying that password has expired. On the client side check the service response for such an error code and redirect the user to the change password page.
您没有指定如何处理应用程序中的权限，但应允许密码已过期的用户登录，但仅获得更改其密码的权限。
在类似的情况下，我们所做的就是允许用户通过 UsernamePasswordValidator，但在 AuthorizationPolicy 中不授予他任何权限。由于我们的所有功能都会检查某些权限，因此除了更改密码之外，用户无法执行任何操作。
You don't specify how you handle permissions in your application, but a user for which the password has expired should be allowed to login but only get permission to change his password.
What we did in a similar situation is to allow the user through the UsernamePasswordValidator but grant him no rights in the AuthorizationPolicy. Since all our functions check for certain permissions the user can't do anything, except changing his password.
密码过期是授权问题，而不是身份验证问题。如果密码已过期，您应该像往常一样对用户进行身份验证，但您应该暂时使所有授权检查失败（允许用户更改密码的检查除外）。
注意：身份验证方法中不需要更改代码，因为在完成身份验证检查时，旧密码仍然有效，因此用户仍然经过身份验证。
Password expiry is an issue with authorization, not authentication. If the password has expired, you should authenticate the user as normal, but you should temporarily fail all authorization checks except the one that allows the user to change password.
NB: No code changes are required in the authentication method, because at the point at which the authentication check is done, the old password is still valid, and thus the user is still authenticated.