WCF 身份验证——对用户/通行证进行一次身份验证，然后再通过其他方式进行身份验证？
基本上，我有以下场景和信息：
- 我们正在使用 HTTPS。
- 我们希望在用户首次登录时通过用户/密码对用户进行身份验证。
- 经过身份验证后，我希望将来对其他服务（不是登录服务）的任何调用都可以使用用户名和某种会话（以防密码更改）在会话中间）。
- 我想确保我的会话可以超时并以某种方式控制它们，如果用户尝试调用服务并且他们没有会话，他们会收到错误（因为他们尚未登录）。不确定是否有 WCF 内置方法可以通过这种方式进行会话，或者我是否必须使用数据库进行一些自定义操作。
- 我认为我们想要使用 WSHttpBinding （不是 BasicHttpBinding），对此有 90% 的把握。
我似乎不知道该怎么做。我经常会找到有关执行 client.ClientCredentials.UserName.UserName = username 和 client.ClientCredentials.UserName.Password = password 的客户端代码的信息。但是，这不起作用，因为我的服务器正在检查什么？我正在尝试获取该信息并根据用户/通行证数据库对其进行验证。我不打算使用 Windows 身份验证或类似的方式（因为我不关心谁登录到计算机，只关心谁登录到应用程序）。
Basically, I have the following scenario and information:
- We're using HTTPS.
- We want to authenticate a user by user/pass when they first log in.
- After they are authenticated, I want any future calls to OTHER services (not the login service) to use the username and some sort of session (in case the password changes in the middle of a session).
- I want to make sure my sessions can timeout and control them in a way that if a user tries to call a service and they don't have a session they get an error (cause they haven't logged in). Not sure if there's a WCF built-in way to do sessions this way or if I'll have to do something customized with a database.
- I think we want to use WSHttpBinding (not BasicHttpBinding), 90% sure on this.
I just can't seem to figure out how to do this. Often time's I'll find information on the client code doing client.ClientCredentials.UserName.UserName = username and client.ClientCredentials.UserName.Password = password. But, that just doesn't work because what is my server checking against? I'm trying to grab that info and validate it against a database of user/passes. I'm not looking to use Windows Authentication or that sort (because I don't care who is logged into the computer, just who is logging into the app).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您想要使用安全令牌服务 (STS) 进行身份验证并获取用于识别用户的安全令牌（可能是 SAML），然后将其传递给您的其他服务，他们只需使用身份信息来识别和授权因为他们相信STS已经预先验证了用户的身份。
这是一个需要讨论的大主题，因此我建议搜索 WCF STS 并执行进行更多研究，但这绝对是我建议的方向。如果您要构建自己的 STS 实现，我还建议您考虑使用 Windows Identity Foundation (WIF) 组件可减轻您的开发工作。
以下是下载链接WIF v1.0 这是本回答时的最新版本。
You want to use a Secure Token Service (STS) to authenticate and get a Security Token (maybe SAML) back that identifies the user which can then be passed to your other services and they can just use the identity information to identify and authorize because they trust the STS has verified the user's identity up front.
This is a large subject to discuss, so I suggest searching for WCF STS and doing some more research, but that's definitely the direction I'd recommend going. If you're going to build your own STS implementation, I also recommend looking into using the Windows Identity Foundation (WIF) components to ease your development efforts.
Here's the download link for WIF v1.0 which is the latest version at the time of this answer.