有没有办法在 WCF 中使用 Windows 身份验证和 webhttpbinding 来获取密码？
我目前有一个自托管的 WCF REST 服务。使用 WebHttpBinding 和 Windows 身份验证，是否可以获取密码，还是必须使用基本身份验证？
I'm currently have a selfhosted WCF REST service. Using WebHttpBinding and Windows authentication, is it possible at all to get the password or do I have to use Basic authentication?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您无法使用 Windows 身份验证获取用户密码 - 因为身份验证是通过第三方（通常是活动目录）完成的，客户端和服务之间不会交换密码，只会交换 AD 颁发的令牌。
能够使用 Windows 身份验证获取密码也会带来巨大的安全风险 - 在 Intranet 中，客户端（例如浏览器）在向需要此类身份验证的服务器进行身份验证时通常不会提示用户输入凭据。您不希望您的密码被移交给您碰巧访问的使用此类身份验证的服务。
You can't get the user password using Windows auth - since the authentication is done via a third party (usually the active directory), no passwords are exchanged between the client and the service, only a token which is issued by the AD.
Being able to get the password using Windows auth would also be a huge security risk - in intranets clients (such as browsers) usually don't prompt the user for credentials when authenticating themselves to a server which requires that kind of authentication. You wouldn't want your password to be handed over to a service which you happen to visit that uses that kind of authentication.