WS-Security 的互操作性如何？
我最近参与了一个涉及 WCF 服务的项目，并使用 wsHttpBinding 进行身份验证。 并且互操作性不够（他们更喜欢 RESTful 方法，使用 GET 传递凭据..）。
使用 PHP 服务的第三方抱怨说，这种方法在 PHP 中不能开箱即用， 使用 PHP 提供服务，他们的论点站得住脚吗？
扩展一下：
无法在您的语言/环境中开箱即用并不一定是缺乏互操作性的一个很好的论据，而且我并不真正相信他们。不过，我很好奇它在更广泛的范围内的互操作性如何，因为我希望我的服务不仅可以由 .NET 客户端轻松使用。
附加说明：
我使用 TransportWithMessageCredential，凭据在服务中验证，而不是由 IIS 验证。以这种方式向 RESTful 服务提供凭据的首选方式是什么？ （这应该是一个单独的问题吗？）。我只是想知道在这种情况下它是否是一个可行的替代方案。
I've recently worked on a project where a WCF service was involved, and a wsHttpBinding was used for authentication. A third party consuming the service with PHP complained that this approach didn't work out of the box in PHP and that it wasn't interopable enough (they preferred a RESTful approach, passing credentials with GET..)
I've never consumed a service with PHP, does their argument hold any water?
To expand:
Not being able to get something working out of the box in your language/environment isn't necessarily a good argument for lack of interopability and I'm not really convinced by them. I'm curious how interopable it is on a broader scale though, as I want my service to be easily consumable not just by .NET clients.
Additional note:
I use TransportWithMessageCredential, the credentials are verified IN the service, and not by IIS. What is the preferred way of supplying credentials to a RESTful service in this manner? (should this be a separate question?). I'm just wondering if it even IS a viable alternative in this scenario.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我的一些客户也遇到了同样的问题（也从 PHP 调用我的服务）。
因此，我们只是公开了一个额外的 basicHttpBinding 端点。
我在该端点中使用传输安全性和用户名密码身份验证。
I had the same problem with some of my clients too (Also calling my service from PHP).
So we just exposed an additional basicHttpBinding Endpoint.
I use Transport security with UsernamePassword authentication in that Endpoint.
确实，REST 非常容易在各种编程平台和操作系统上实现（包括 Linux 上的 PHP，这是一种非常常见的设置）。
WS-Security 作为 SOAP 的扩展，是一种标准化协议，并且存在针对 .NET 之外的其他平台的实现。然而，这里的免费库的范围非常有限（对于 PHP，我什么都不知道），这肯定意味着连接到 WS-Security 服务比连接到简单的 REST 服务要付出更多的努力，至少如果该服务使用协议的话超出了普通 SOAP 范围的功能。
还有一件事：HTTP 内置了身份验证支持，因此您绝对可以实现经过身份验证的 RESTful 服务，而无需向请求的 URL 添加凭据。
It's true that REST is very easy to implement on a wide range of programming platforms and operating systems (including, for instance, PHP on a Linux box, which is a very common setup).
WS-Security, as an extension to SOAP, is a standardized protocol and there exist implementations for other platforms than .NET. However, the range of free libraries here is very limited (for PHP, I don't know any) and it surely means more effort to connect to a WS-Security service than to a simple REST service, at least if the service uses protocol features that go beyond the scope of plain SOAP.
One more thing: HTTP has authentication support built in, so you can absolutely implement an authenticated RESTful service without adding credentials to the requested URL.