具有混合客户端的 WCF 授权令牌
我正在为应用程序开发一些 WCF 服务，这些服务不仅由我们的 Web 应用程序使用，而且还可以从我们的客户内部应用程序使用。由于我们不知道客户端内部应用程序可能处于什么环境，因此我们将采用最小公分母路线。
我们将有一个身份验证服务，它将返回一个令牌，并且该令牌将作为每个方法调用的第一个参数传递。我的问题是，我想要一种干净的方法来检查令牌，而不必将对令牌检查逻辑的调用作为每个服务方法中的第一行代码。
我研究了在 BeforeCall 方法中实现参数检查器，这在我的第一个概念证明中效果很好，但我不喜欢的是必须抛出异常来让消费者知道令牌无效。我的所有方法都将返回一个至少具有 2 个基本属性的结果 - 成功和错误消息列表。我很乐意将 inavlid 令牌信息作为结果的错误消息之一返回，因为对我来说，无效令牌不是例外，它是一种验证，但我没有看到一种干净的方法来透明地完成此操作。
我几乎去寻找参数检查器的 AfterCall 方法的返回值，但这允许该方法执行。
所以我认为我有两个选择 - 1 - 将令牌检查调用作为每个方法的第一行，这将填充我的返回结果对象 2 - 在参数检查器中抛出异常，这实际上并没有那么糟糕。
有没有人找到一个好方法来做到这一点？
谢谢， 保罗
I am working on some WCF services for an application that are not only consumed by our web app but would also be consumable from our clients internal applications. Since we will not know what environment the clients internal apps could be in we are going to go the least common denominator route.
We will have an authentication service that will return a token, and that token will be passed as the first parameter of every method call. My issue is that I would like a clean way to examine the token without having to put the call to the token checking logic as the first line of code in each service method.
I looked at implementing a parameter inspector in the BeforeCall method and that worked great in my first proof of concept, but what I don't like is having to throw an exception to let the consumer know that the token is not valid. All of my methods will return a result that has at least 2 basic properties - success and a list of error messages. I would love to just return the inavlid token information as one of the result's error messages because to me, an invalid token is not an exception, it is a validation, but I do not see a clean way to accomplish this transparently.
I almost went for the return value the the parameter inspector's AfterCall method but that allows the method to execute.
So I think that i have 2 choices -
1 - Put a token check call as the first line of each method which will populate my returning result object
2 - Throw an exceptioon in the parameter inspector, which really isn't all that bad.
Has anybody found a good way to do this?
Thanks,
Paul
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我真的认为你应该重新考虑这种方法。每个堆栈都理解肥皂头，即使人们自己构建 XML 字符串。只要不要做任何像消息安全这样的事情，就互操作而言，你应该没问题。
如果您仍然想走这条路，您可能只需编写一个自定义
IParameterInspector您可以使用行为将其附加到服务。然后只需重写 BeforeCall 方法并检查那里的令牌即可。I really think you should reconsider this approach. Every stack understands soap headers, even if the person is building XML strings themselves. Just don't do anying like message security and you should be ok as far as interop goes.
If you still want to go this route, you could probably just write a custom
IParameterInspectorwhich you can attach to the services using a behavior. Then just override the BeforeCall method and check the token there.