将PrincipalPermissionAttribute 与自定义角色提供程序结合使用

Question

我正在为我的组织开发新的安全基础设施。由于我们开发供内部组织使用的系统，我想使用 Windows 身份验证，但为了授权，我们管理一个单独的 Oracle DB（由于历史原因）。我的想法是使用

AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);

Global::Application_Start 中 定义的 PrincipalPermissionAttribute 并

<system.web>
    <compilation debug="true" targetFramework="4.0" />
    <authorization>
      <deny users="?"/>
    </authorization>
    <roleManager **defaultProvider="MyRoleProvider"**
      enabled="true"
      cacheRolesInCookie="true"
      cookieName=".ASPROLES"
      cookieTimeout="30"
      cookiePath="/"
      cookieRequireSSL="false"
      cookieSlidingExpiration="true"
      cookieProtection="All" >
      <providers>
        <clear />
        <add
          name="MyRoleProvider"
          type="WcfServiceLibrary1.MyRoleProvider"
          connectionStringName="Service1"
          applicationName="InfraTest"
          writeExceptionsToEventLog="true" />
      </providers>
    </roleManager>
  </system.web>
  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="BasicHttpEndpointBinding">
          <security mode="TransportCredentialOnly">
            <transport **clientCredentialType="Windows"** />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <services>
      <service name="WcfService1.Service1">
        <endpoint address="WcfAuthenticationTest" binding="basicHttpBinding"
          bindingConfiguration="BasicHttpEndpointBinding" name="BasicHttpEndpoint"
          contract="WcfService1.IService1">
          <identity>
            <dns value="localhost"/>
          </identity>
        </endpoint>
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost/WcfAuthentication"/>
          </baseAddresses>
        </host>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceAuthorization **principalPermissionMode="UseAspNetRoles"**/>
          <serviceMetadata httpGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="true"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true"/>
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>

在我的 Web.config 中使用我的自定义角色提供程序，它应该访问 Oracle DB 以检查角色。但我无法让它发挥作用。有什么方法可以使 PrincipalPermissionAttribute 以这种方式工作，或者整个概念可能是错误的？我想过实现我的自定义 CodeAccessSecurityAttribute 但它并不那么简单，所以我不想这样做 有人对这个问题有任何想法吗？我会很高兴得到一些答案

Answer 1

最近我学到了两件事。首先，我的概念是正确的，我可以将 PrinciplePermissionAttribute 与自定义角色提供程序一起使用，第二是我对 web.config 标签完全感到困惑。 tag 用于asp .net 设置，而用于WCF 设置。所以一点点配置就解决了整个问题。这是正确的配置

<?xml version="1.0"?>
<configuration>

  <system.web>
    <compilation debug="true" defaultLanguage="c#" targetFramework="4.0" />

    <roleManager enabled="true" cacheRolesInCookie="true" cookieName=".ASPROLES"
      defaultProvider="MyRoleProvider">
      <providers>
        <clear />
        <add connectionStringName="Service1" applicationName="InfraTest"
          writeExceptionsToEventLog="false" name="MyRoleProvider" type="SecLib.MyRoleProvider" />
      </providers>
    </roleManager>

  </system.web>
  <system.serviceModel>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
    <bindings>
      <basicHttpBinding>
        <binding name="BasicHttpBindingConfiguration" closeTimeout="00:01:00"
          sendTimeout="00:10:00" maxBufferSize="524288" maxReceivedMessageSize="524288">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Windows" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <services>
      <service name="WcfRoleProviderTestService.Service1"
               behaviorConfiguration="BasicHttpServiceBehavior" >
        <endpoint name="BasicHttpEndpoint"
                  contract="WcfRoleProviderTestService.IService1"
                  address="WcfAuthenticationTest"
                  binding="basicHttpBinding"
                  bindingConfiguration="BasicHttpBindingConfiguration" />
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost/WcfRoleProviderTestService/" />
          </baseAddresses>
        </host>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="BasicHttpServiceBehavior">
          <serviceAuthorization principalPermissionMode="UseAspNetRoles"
            roleProviderName="MyRoleProvider" impersonateCallerForAllOperations="true" />
          <serviceMetadata httpGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
        <behavior name="">
          <serviceMetadata httpGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
 <system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>
</configuration>

Answer 2

除非您需要模拟，否则不需要包含 impersonateCallerForAllOperations="true"