WCF基于用户名和密码安全成功测试

经过多次测试，终于探出一种很合适我使用的WCF安全验证模式。

目标：
１.客户端与服务器端通信使用x509证书验证，但不用客户端安装证书。只需要服务器端配置好证书即可。
２.验证使用用户名密码形式。

操作：
（这里的测试使用wcf项目模板缺省的服务，即只要新建一个使用vs2008自动生成的wcf项目就行了，

它会自动生成有一个GetData方法，我就用这个方法进行测试）

1.新建WCF服务应用程序.

1.1生成一个服务器证书：运行Visual Studio 2008 命令提示工具：

输入：makecert -r -pe -n "CN=MyServer" -sr LocalMachine -ss My -sky exchange执行。

-sr LocalMachine 请一定保存到LodcalMachine中.目的就是到时如果你部署这个wcf服务的时候可以让IIS找到证书，

反之，IIS会报找不到x509证书.

2.配置web.config文件：
这里要注意的是把storeLocation设为LocalMachine,原因也是到时需要部署的时候可以免掉很多麻烦，因为以后发布到iis时很可以不能正常验证到证书的私钥.

<system.serviceModel>

<bindings>

<wsHttpBinding>

<binding name="NewBinding0">

<security>

<message clientCredentialType="UserName" />

</security>

</binding>

</wsHttpBinding>

</bindings>

<services>

<service behaviorConfiguration="WcfService2.Service1Behavior"

name="WcfService2.Service1">

<endpoint address="" binding="wsHttpBinding" bindingConfiguration="NewBinding0"

contract="WcfService2.IService1">

</endpoint>

<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />

</service>

</services>

<behaviors>

<serviceBehaviors>

<behavior name="WcfService2.Service1Behavior">

<serviceMetadata httpGetEnabled="true" />

<serviceDebug includeExceptionDetailInFaults="false" />

<serviceCredentials>

<clientCertificate>

<authentication certificateValidationMode="None" />

</clientCertificate>

<serviceCertificate findValue="MyServer" storeLocation="LocalMachine" x509FindType="FindBySubjectName" />

<userNameAuthentication userNamePasswordValidationMode="Custom"

customUserNamePasswordValidatorType="WcfService2.MyUserNamePasswordValidator,WcfService2" />

</serviceCredentials>

</behavior>

</serviceBehaviors>

</behaviors>

</system.serviceModel>

3.建造验证客户端用户名和密码的方法.

这里注意的是必须与web.config文件中的customUserNamePasswordValidatorType=中的内容一致，

格式是："命名空间.方法名,命名空间"

实际项目应用中这里应该是从数据库里确认用客是否合法。

namespace WcfService2

{

public class MyUserNamePasswordValidator : UserNamePasswordValidator

{

public override void Validate(string userName, string password)

{

if (userName != "jac" || password != "jac")

{

throw new SecurityTokenException("Unknown Username or Password");

}

}

}

}

至此，wcf服务配置完成。

4.新建一个asp.net项目，并添加服务引用这个wcf服务.

5.修改asp.net项目的web.config文件(一定要在引用wcf服务后）.

添加一个endpointBehaviors,

<behaviors>

<endpointBehaviors>

<behavior name="jacBehavior">

<clientCredentials>

<serviceCertificate>

<authentication certificateValidationMode="None" />

</serviceCertificate>

</clientCredentials>

</behavior>

</endpointBehaviors>

</behaviors>

然后让它生效,

<endpoint address="http://j-8de9be98d1184/Service1.svc" behaviorConfiguration="jacBehavior"

binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService1"

contract="ServiceReference1.IService1" name="WSHttpBinding_IService1">

发下是完整的asp.net客户端的web.config文件的system.serviceModel部份

<system.serviceModel>

<behaviors>

<endpointBehaviors>

<behavior name="jacBehavior">

<clientCredentials>

<serviceCertificate>

<authentication certificateValidationMode="None" />

</serviceCertificate>

</clientCredentials>

</behavior>

</endpointBehaviors>

</behaviors>

<bindings>

<wsHttpBinding>

<binding name="WSHttpBinding_IService1" closeTimeout="00:01:00"

openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"

bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"

maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"

textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">

<readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"

maxBytesPerRead="4096" maxNameTableCharCount="16384" />

<reliableSession ordered="true" inactivityTimeout="00:10:00"

enabled="false" />

<security mode="Message">

<transport clientCredentialType="Windows" proxyCredentialType="None"

realm="" />

<message clientCredentialType="UserName" negotiateServiceCredential="true"

algorithmSuite="Default" establishSecurityContext="true" />

</security>

</binding>

</wsHttpBinding>

</bindings>

<client>

<endpoint address="http://j-8de9be98d1184/Service1.svc" behaviorConfiguration="jacBehavior"

binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService1"

contract="ServiceReference1.IService1" name="WSHttpBinding_IService1">

<identity>

<certificate encodedValue="AwAAAAEA.....................eGtnWJsvtFQsEuzDYw==" />

</identity>

</endpoint>

</client>

</system.serviceModel>

6.调用.

ServiceReference1.Service1Client sc = new WebApplication1.ServiceReference1.Service1Client();

sc.ClientCredentials.UserName.UserName = "jac";

sc.ClientCredentials.UserName.Password = "jac";

Label1.Text = sc.GetData(22);

完成。

源文件请到我的资源中下载.

还想提下，这个csdn博客的写博客的TextEditer烂到极点了。。