将 Identity Foundation 与 WCF Web Api 结合使用
我有很多网站的设置相同，都使用 WIF 身份提供商。我最近将业务逻辑从 Web 应用程序移至 Web Api 服务应用程序中。它在与其他站点不同的虚拟目录中运行。这个想法是浏览器将数据放入 AJAXy 页面中。
我遇到的问题是保护 Web API。看起来 WIF 单点登录在传统网站上工作得很好。用户可以访问一个网站，重定向到身份提供商，登录并重定向回他们想要的网站。当他们访问另一个站点时，他们也会被重定向回身份提供商，但不需要登录，因为存在 FEDAUTH cookie，因此他们会自动获得身份验证并重定向到第二个站点。
这不适用于 Web Api 场景，因为当浏览器可能对其进行 GET 时，Api 会在需要 JSON 时返回到调用 JavaScript 的重定向。
是否有可能使用 WIF 来保护 Web Api 的安全？
I have a bunch of websites that are setup identically to use a WIF identity provider. I've recently moved the business logic out of the web applications and into a Web Api service application. This runs in a different virtual directory to the other sites. The idea being that browser will put the data into the page AJAXy.
The issue I have is with securing the web API. It seems that WIF single sign-on works okay with traditional sites. The user can access one website, get redirected to the identity provider, login and get redirected back to the website they wanted. When they access another site they also get redirected back to the identity provider but needn't log in as a FEDAUTH cookie exists so they automatically get authenticated and redirected to the second site.
This doesn't work for the Web Api scenario because when the browser perhaps makes a GET to it, the Api will return a redirect to the calling javascript when it should be expecting JSON.
Is it even possible to secure Web Api with WIF?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不确定我是否理解正确，但似乎主要问题是 javascript/ajax 不支持 http 重定向。
一种可能的解决方案是使用 ajax 中的一系列单独调用来模拟重定向：
如果不是这种情况：
多米尼克·拜尔 (Dominick Bayer) 撰写了几篇有关确保休息服务安全的博客文章。如需进一步阅读，请访问 http://www.leastprivilege.com/。 （特别是 http:// leastprivilege.com/2009/09/11/adding-a-rest-endpoint-to-a-wif-token-service/ 和
http:// leastprivilege.com/2010/05/05/thinktecture-identitymodel-wif-support-for-wcf-rest-services-and-odata/）。
TechDays 上的以下演示可能也很有趣：http://www.microsoft.com/showcase/sv/se/details/ffc61019-9756-4175-adf4-7bdbc6dee400（大约 30 分钟开始）。
Not sure whether I got you right, but it seems like the main problem is that javascript/ajax does not support http redirects.
A possible solution could be to simulate the redirection with a sequence of seperate calls in ajax:
If this is not the case:
Dominick Bayer wrote a few blog posts about securing rest services. For further reading have a look at http://www.leastprivilege.com/. (Especially http://leastprivilege.com/2009/09/11/adding-a-rest-endpoint-to-a-wif-token-service/ and
http://leastprivilege.com/2010/05/05/thinktecture-identitymodel-wif-support-for-wcf-rest-services-and-odata/).
The following presentation from TechDays might also be interesting: http://www.microsoft.com/showcase/sv/se/details/ffc61019-9756-4175-adf4-7bdbc6dee400 (starting at about ~ 30 minutes).