使用 HTTP 上的自定义绑定在我的 WCF 服务上实现传输安全

Question

我是 WCF 安全新手。我正在尝试在我的 WCF 服务上实现传输安全性。我们在 HTTP 上使用自定义绑定。有人可以建议我们如何做到这一点吗？

<customBinding> <binding name="CustomBinding"> <binaryMessageEncoding/> <httpTransport allowCookies="true" maxReceivedMessageSize="2000000000" maxBufferSize="2000000000" maxBufferPoolSize="2000000000"/> </binding> </customBinding>

Answer 1

您将希望使用证书来实现传输级别的安全性。

---

您可以使用本教程（如下）了解如何创建“测试”证书；对于生产，我建议使用您自己公司的内部 CA（如果他们有的话）或使用受信任的提供商（赛门铁克、GlobalSign 等）颁发证书。

http://msdn.microsoft.com/en-us/library/bfsktky3(v=vs.110).aspx

---

您可以使用本教程（如下）了解如何在盒子上安装证书。

http://msdn.microsoft.com/en-us/library/bb950259(v=bts.10).aspx

---

就服务 app.config 而言 -- 它应该是 something 如下所示：

<system.serviceModel>
  <services>
    <service name="YourServiceNameGoesHere" behaviorConfiguration="MyCustomBehavior">
      <endpoint address="YourAddressGoesHere" binding="customBinding" contract="YourIContractNameGoesHere" bindingConfiguration="MyCustomBinding"/>
    </service>
  </services>

  <behaviors>
    <serviceBehaviors>
      <behavior name="MyCustomBehavior">
        <serviceMetadata httpsGetEnabled="true" />
        <serviceCredentials>
          <clientCertificate>
            <authentication certificateValidationMode="None" trustedStoreLocation="LocalMachine" />
          </clientCertificate>
          <serviceCertificate findValue="YourCertNameGoesHere" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/>
        </serviceCredentials>
      </behavior>
    </serviceBehaviors>
  </behaviors>

  <bindings>
    <customBinding>
      <binding name="MyCustomBinding">
        <security authenticationMode="CertificateOverTransport" />                    
        <httpsTransport />
      </binding>
    </customBinding>
  </bindings>
</system.serviceModel>

---

至于客户端 app.config -- 它应该是 something 如下所示：

 <system.serviceModel>
    <client>
      <endpoint address="YourAddressGoesHere" binding="customBinding" bindingConfiguration="MyCustomBinding" behaviorConfiguration="MyCustomBehavior" contract="YourIContractNameGoesHere" name="YourClientNameGoesHere" />
    </client>

    <behaviors>
      <endpointBehaviors>
        <behavior name="MyCustomBehavior">
          <clientCredentials>
            <clientCertificate findValue="YourCertNameGoesHere" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>

    <bindings>
      <customBinding>
        <binding name="MyCustomBinding">
          <security mode="Transport">
            <transport clientCredentialType="Certificate" />
          </security>
          <httpsTransport />
        </binding>
      </customBinding>
    </bindings>
  </system.serviceModel>