我正在使用 ASP.NET MVC 3 构建一个网站，并正确设置表单身份验证（用户能够注册和登录）。我想要设置 OData WCF 数据服务服务，以便 Windows Phone 7 (Mango Beta 2 Refresh) 客户端可以通过 CRUD 操作对 Odata 服务进行身份验证和查询。这个想法来自此处的 FullStack 剧集。他们使用 OAuth 登录，但我想使用已有的用户设置，而不是 OAuth 解决方案。
我目前确实在没有身份验证的情况下完成了这一切（wp7 上带有 Odata 客户端的 MVC 应用程序），但我希望确保 Odata 服务的安全。我想我正在寻找一些关于如何使其发挥作用的文章或演练。
如果表单身份验证不是正确的选择，请告诉我。
更新
对此进行了大量研究。 此处。由于表单身份验证已在 Web 应用程序上配置，因此在 QueryInterceptor 内添加检查即可提供身份验证。然而，它使用“标准身份验证端点”让客户端应用程序实际“登录”，这似乎使用了我不使用的基本会员资格提供程序。有没有办法覆盖这个？
I am building a website using ASP.NET MVC 3 and have forms authetication setup correctly (user is able to register and login). I want to setup an OData WCF Data Services service so a Windows Phone 7 (Mango Beta 2 Refresh) client can authenticate and query the Odata service, with CRUD actions. This idea comes from the FullStack episodes here. They use OAuth login, but I wanted to use the user setup I already have, instead of an OAuth solution.
I do have this all working without auth currently (MVC app with Odata client on wp7), but am looking to make the Odata service secure. I guess I am looking for some articles or walkthroughs on how to get this working.
If forms authentication is not the correct choice, please let me know.
UPDATE
So lots of research done on this. There is an official how-to series on the blog for the WCF team here. Since forms auth is already configured on the web app, adding a check inside the QueryInterceptor provides the auth. However it uses a 'standard authentication endpoint' for client apps to actually 'login' that seems to use the base Membership providers, which I don't use. Is there a way to override this?
发布评论
评论（1）
您可以使用 联合身份验证提供程序 (STS) href="http://msdn.microsoft.com/en-us/security/aa570351" rel="nofollow">Windows Identity Foundation。然后使用它向 STS 提供商验证您的 wp7 应用程序，然后将该声明（令牌）发送到您的 Odata 服务，该服务将验证其真实声明。 WIF 培训工具包中有一个示例
You could turn your custom forms authentication setup into a Claims based Federated Authentication Provider (STS) using Windows Identity Foundation. Then use that to authenticate your wp7 app with the STS provider and then send that claim (token) to your Odata service which will verify its an authentic claim. There is an example of this in the WIF training kit