CF 应用程序消耗的 WCF
我有一个 WCF Web 服务，需要由 Coldfusion 应用程序使用。 这不是真正的问题。问题是该服务在 IIS 下以特定用户运行。我如何判断目标应用程序何时调用服务，特定应用程序正在调用服务而不是幽灵应用程序。
例如：
应用程序 x 正在调用服务 y，应该没问题。 此外，应用程序 z 正在调用服务 y，并且不应允许它这样做。
I have a WCF web service that needs to be consumed by a Coldfusion application.
That's not the real problem. The problem is that the service runs under IIS with a specific user. How can i tell when the target application is calling the service that the specific application is calling the service and not a ghost app.
For example:
application x is calling service y and it should be okay.
also application z is calling service y and it shouldn't be allowed to do so.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
根据@Justin 的回答中的评论，CF 客户端似乎只能支持 WS-I Basic Profile。这使用内置的 HTTP Basic 身份验证机制。 这里有一篇文章，解释了如何为此身份验证模式配置 WCF 服务。
本文解释了如何配置 IIS 以实际支持 HTTP 基本身份验证。如果将 IIS 主机设置为具有与提交到服务的用户名和密码匹配的本地计算机（首选）或域 Windows 帐户，则可以跳过创建自定义身份验证器。否则，您编写的自定义验证器将确定谁有权调用您的服务。
回答评论问题：如果您没有像第二篇文章中那样配置 IIS，那么您将作为服务的用户获得匿名。
Based on comments in the answer from @Justin, it seems the CF client can only support the WS-I Basic Profile. This uses the built-in HTTP Basic authentication mechanism. Here is an article that explains how to configure a WCF service for this mode of authentication.
This article explains how you need to configure IIS to actually support HTTP Basic authentication. You can skip creating a custom authenticator if you set IIS host machine to have either a local machine (prefered) or domain Windows account that match the user name and password submitted to the service. Otherwise, the custom validator you write will determine who is authorized to invoke your service.
To respond to comment question: If you didn't configure IIS as in the second article, then you would get anonymous as the user of your service.
听起来您需要为 WCF 服务设置某种身份验证：
安全消息使用消息安全性
简而言之，您将向授权应用程序提供令牌或用户名/密码，然后他们会将该信息连同请求一起传递给您。然后，您可以验证调用应用程序是否有权使用您的服务。
It sounds like you need to set up some sort of authentication for your WCF Service:
Security Messages Using Message Security
The long in short of it is that you would provide a token or username/password to authorized applications and then they would pass that information to you along with their request. You can then validate that the calling application is authorized to use your service or not.
如果您谈论 WCF 服务的安全性，答案是应用安全层。例如，您可以执行基本安全性，其中每个授权应用程序都使用用户名和密码来访问服务。但是，如果您想要 Active Directory 身份验证之类的功能，则需要使用更复杂的身份验证设置。一种方法是使用 WIF (http://msdn.microsoft.com/en-us/magazine/ee335707.aspx)。有一些很好的示例说明了如何实现这一点以允许更安全的 WCF 应用程序。
If you are talking about the security on your WCF service, the answer would be to apply a security layer. For example, you could do basic security, where each authorized application uses a username and password to access the service. However, if you want something like Active Directory authentication, you will need to use a more complex authentication setup. One way to do that would be to use WIF (http://msdn.microsoft.com/en-us/magazine/ee335707.aspx). There are some good examples out there of how that can be implemented to allow for more secure WCF applications.