【发布时间】：2014-05-02 22:04:59
【问题描述】：
我学习了一个使用用户名和密码以及证书来保护 wcf 服务的教程。
我使用 pluralsight 的 self-Cert 工具创建并安装了证书。并覆盖从 UserNamePasswordValidator 继承的 validate 方法。证书安全工作正常，但在服务调用期间未调用验证方法。无需提供用户名和密码即可访问服务。
我阅读了很多关于它的文章，但那里显示了相同的过程。我还阅读了有关相同问题的其他堆栈溢出问题，但我无法找到解决方案。
验证码
using System;
using System.IdentityModel.Selectors;
using System.ServiceModel;
namespace WcfSecure
{
public class CredentialValidator : UserNamePasswordValidator
{
public override void Validate(string userName, string password)
{
if (userName == null && password == null)
throw new ArgumentNullException();
if (!(userName == "one" && password == "two"))
throw new FaultException("Wrong Credentials!");
}
}
}
这里是服务合同。
using System.ServiceModel;
namespace WcfSecure
{
[ServiceContract]
public interface ISecureWebService
{
[OperationContract]
int SecureAdd(int x, int y);
[OperationContract]
int UnSecureService(int x, int y);
}
}
服务代码
namespace WcfSecure
{
public class SecureWebService : ISecureWebService
{
public int SecureAdd(int x, int y)
{
return x + y;
}
public int UnSecureService(int x, int y)
{
return x + y;
}
}
}
还有最重要的 Web.config
<?xml version="1.0"?>
<configuration>
<appSettings>
<add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
</appSettings>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5"/>
</system.web>
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="SecureBinding">
<security mode="Message">
<message clientCredentialType="UserName" establishSecurityContext="true"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors >
<behavior name="CustomBehavior">
<!-- To avoid disclosing metadata information, set the values below to false before deployment -->
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
<serviceCredentials>
<serviceCertificate findValue="SecureService"
storeLocation="LocalMachine"
storeName="My"
x509FindType="FindBySubjectName"/>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="WcfSecure.CredentialValidator, WcfSecure" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="CustomBehavior" name ="WcfSecure.SecureWebService">
<endpoint address="" binding="wsHttpBinding" contract="WcfSecure.ISecureWebService"></endpoint>
<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"></endpoint>
<host>
<baseAddresses>
<add baseAddress="http://192.168.1.224:84/WcfSecure/SecureWebService"/>
</baseAddresses>
</host>
</service>
</services>
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
<!--
To browse web app root directory during debugging, set the value below to true.
Set to false before deployment to avoid disclosing web app folder information.
-->
<directoryBrowse enabled="true"/>
</system.webServer>
</configuration>
【问题讨论】：
-
我不确定您为什么要实现自己的验证器。我有 WCF 服务，这些服务由带有用户名/密码验证的证书保护，我不必接触任何 WCF 类。
-
能否分享一下它的工作原理或演示代码。
标签： wcf wcf-security