WCF安全操练（2）--WCF服务端

说明：要建立的WCF服务的安全验证方式为TransportWithMessageCredential，这意味着建立客户端调用WCF服务时，即要信任服务器端的证书，又要提供用户名和密码。好处第一是安全，第二是可以对服务中的任何方法实现权限控制。

在.NET 2008中新建项目，项目模板选WCF服务应用程序。

在项目中添加对System.IdentityModel的引用。

在项目中添加一个新类，该类可以做用户的简单认证或是保存调用服务者的信息，我主要将该类用于后者。类代码如下：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Text;
using System.IdentityModel.Selectors;
using System.IdentityModel.Tokens;

namespace WcfServiceForMyself
{
    public class UserValidator : UserNamePasswordValidator
    {
        string customUserName;
        string custompassword;

        public override void Validate(string userName, string password)
        {
            

            if (string.IsNullOrEmpty(userName))
                throw new ArgumentNullException("userName");
            if (string.IsNullOrEmpty(password))
                throw new ArgumentNullException("password");
            //这里可加简单的用户判断，如
            //if (userName != "Admin" || password != "123")
            //    throw new SecurityTokenException("用户名或者密码错误！");

            customUserName = userName;
            custompassword = password;
        }

        public string CustomUserName
        {
            get
            {
                return customUserName;
            }
        }

        public string CustomPassWord
        {
            get
            {
                return custompassword;
            }
        }
    }
}

服务的接口如下：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.Serialization;
using System.ServiceModel;
using System.Text;

namespace WcfServiceForMyself
{
    // NOTE: If you change the interface name "IServiceForMyself" here, you must also update the reference to "IServiceForMyself" in Web.config.
    [ServiceContract]
    public interface IServiceForMyself
    {
        [OperationContract]
        string PrintMessage(string message);
    }
}

服务实现如下：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.Serialization;
using System.ServiceModel;
using System.Text;
using System.IdentityModel.Selectors;
using System.IdentityModel.Tokens;

namespace WcfServiceForMyself
{
    // NOTE: If you change the class name "ServiceForMyself" here, you must also update the reference to "ServiceForMyself" in Web.config.
    public class ServiceForMyself : IServiceForMyself
    {
        //
        WcfServiceForMyself.UserValidator myClientUser;

        public ServiceForMyself()
        {
            myClientUser = (WcfServiceForMyself.UserValidator)OperationContext.Current.Host.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator;
        }

        public WcfServiceForMyself.UserValidator MyClientUser
        {
            get
            {
                return myClientUser;
            }
        }

        public string PrintMessage(string msg)
        {
            //此时可根据客户端的用户来判断用户是否有权调用接口，如
            if (myClientUser.CustomUserName == "Admin")
            {
                msg = "输出信息(" + msg + ")";
                return msg;
            }
            else
            {
                return "你没有调用此接口的权限";
            }
        }
    }
}

注意以下Web.Config中的<system.serviceModel>中的配置，如下：

<system.serviceModel>
        <behaviors>
            <serviceBehaviors>
                <behavior name="WcfServiceForMyself.ServiceForMyselfBehavior">
                    <serviceMetadata httpsGetEnabled="true" />
                    <serviceDebug includeExceptionDetailInFaults="false" />
                  <serviceCredentials>
                    <issuedTokenAuthentication allowUntrustedRsaIssuers="true"></issuedTokenAuthentication>
                    <clientCertificate>
                      <authentication certificateValidationMode="None"/>
                    </clientCertificate>
                    <serviceCertificate findValue="10.11.41.87" storeLocation="LocalMachine" x509FindType="FindBySubjectName" storeName="My"/>
                    <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="WcfServiceForMyself.UserValidator,WcfServiceForMyself"/>
                  </serviceCredentials>
                </behavior>
            </serviceBehaviors>
        </behaviors>
        <services>
            <service behaviorConfiguration="WcfServiceForMyself.ServiceForMyselfBehavior"
                name="WcfServiceForMyself.ServiceForMyself">
                <endpoint address="" binding="basicHttpBinding" contract="WcfServiceForMyself.IServiceForMyself" bindingConfiguration="myUserSafeBinding">
                    <identity>
                        <dns value="10.11.41.87" />
                    </identity>
                </endpoint>
                <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
            </service>
        </services>
      <bindings>
        <basicHttpBinding>
          <binding name="myUserSafeBinding">
            <security mode="TransportWithMessageCredential">
              <transport clientCredentialType="Windows"/>
              <message clientCredentialType="UserName"/>
            </security>
          </binding>
        </basicHttpBinding>
      </bindings>
    </system.serviceModel>

我建立的这个WCF服务是想要在silverlight3中应用的，所以用的是basicHttpBinding方式。

好了，服务完成了，发布到IIS中，发布后将该服务按下图配置：



在安全通信中点击编辑，选择如下：



确定后完成配置，OK，服务端的程序完成。