具有 netTCPbinding 和 DMZ 客户端的 WCF 服务
我们有一个 WCF 服务，netTCPBinding 托管在 Windows 服务中，该服务连接到 ContentManager 服务器来上传文档并添加一些元数据，检索文档 ID 并将其传递给 .Net 应用程序，客户端使用 Windows 身份验证进行身份验证。我们编写了一个 WCF 客户端库，供其他想要通过引用此 dll 来上传文档的业务应用程序用作代理。只要客户端应用程序位于 Intranet 域内，所有这些都可以正常工作。
现在需要通过通过手机访问的 Web 应用程序使用此服务，移动应用程序访问旧版 asmx Web 服务，该服务引用代理来连接到 WCF 服务，而 WCF 服务又与另一个后端 WCF 服务通信并上传到内容管理器，asmx web 服务托管在 DMZ 中当前域之外的服务器中，并且公司域和 DMZ 之间没有信任，我们在两台服务器上打开了必要的端口，但由于客户端凭据类型是 windows，因此它会抛出“The远程服务器不满足相互身份验证要求。”这是预期的。现在，出于明显的性能原因，我们希望使用 nettcpbinding，因为文档是通过手机从远程位置扫描和发送的，而且重写的时间很少，这不是一个选择。在我读过的文章和这里的讨论中，大多数人建议不要在这种情况下使用 netTCPBinding，并且有一些尝试使用证书来实现这一点，
我的问题是
- 对于我上面提到的场景，使用证书来验证客户端是否是正确的方法？
- 我应该如何处理安全性，现在几乎所有操作都使用声明性模拟，如果我必须更改安全性，我怎样才能在不影响使用该服务的其他应用程序的情况下做到这一点。
我以前没有处理过证书，因此有关该场景的指导也会有很大帮助。
We have a WCF service with netTCPBinding hosted in a windows service, this service connects to ContentManager server to upload documents and add some metadata, retrieve the documentID and passes it to a .Net Application, the clients are authenticated using windows authentiation. We wrote a WCF client library to be used as a proxy by other line of business applications which wants to upload documents by just referencing this dll. All this works fine as long as the client apps are within the intranet domain.
Now there is a requirement to use this service by an web app accessed via mobile phones, the mobile application accesses a legacy asmx webservice which references the proxy to connect to the WCF service which in turn talks to another backend wcf service and uploads to content manager, the asmx webservice is hosted in servers outside of current domain in DMZ and there is no trust between the corporate domain and DMZ, we opened the necessary ports on both the servers, but since the client credentialtype is windows, it throws "The remote server did not satisfy the mutual authentication requirement." which is expected. Now we want to use the nettcpbinding for obvious reasons of performance since documents are scanned and sent via mobilephones from remote locations, and also with very little time rewriting this is not an option. In the articles i read and the discussions here most of them suggest against using netTCPBinding for this scenario, and a few tried and implemented this using certficates,
my questions are
- For the scenarios i mentioned above does using Certficates to autheticate clients the right approach?
- How should i handle security, right now declarative impersonation is used on almost all operations, if i have to change security how can i do it without impacting other applications using the service.
I have not worked on certficates before so a guidance with respect to the scenario will also be of great help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论