<a href="http://webabcd.blog.51cto.com/1787395/343999" target="_blank">[索引頁]</a>
化零為整WCF(17) - 安全(Security)
介紹
WCF(Windows Communication Foundation) - 安全(Security)：本文以使用者名和密碼做驗證，通過X.509證書做加密為例
示例
1、證書
setup.bat
makecert -sr LocalMachine -ss My -a sha1 -n CN=Webabcd -sky exchange -pe
certmgr -add -r LocalMachine -s My -c -n Webabcd -s TrustedPeople
2、服務
IHello.cs
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.ServiceModel;
namespace WCF.ServiceLib.Security
{
/// <summary>
/// IHello接口
/// </summary>
[ServiceContract]
public interface IHello
{
/// <summary>
/// 打招呼方法
/// </summary>
/// <param name="name">人名</param>
/// <returns></returns>
[OperationContract]
string SayHello(string name);
}
}
Hello.cs
/// Hello類
public class Hello : IHello
public string SayHello(string name)
{
return "Hello: " + name;
}
CustomNamePasswordValidator.cs
/// 自定義的使用者名/密碼驗證類
public class CustomNamePasswordValidator : System.IdentityModel.Selectors.UserNamePasswordValidator
/// 驗證指定的使用者名和密碼
/// <param name="userName">要驗證的使用者名</param>
/// <param name="password">要驗證的密碼</param>
public override void Validate(string userName, string password)
if (!(userName == "webabcd" && password == "webabcd"))
{
throw new FaultException("使用者名或密碼不正确");
}
3、宿主
Hello.svc
<%@ ServiceHost Language="C#" Debug="true" Service="WCF.ServiceLib.Security.Hello" %>
Web.config
<?xml version="1.0"?>
<configuration>
<system.serviceModel>
<services>
<!--name - 提供服務的類名-->
<!--behaviorConfiguration - 指定相關的行為配置-->
<service name="WCF.ServiceLib.Security.Hello" behaviorConfiguration="SecurityBehavior">
<!--address - 服務位址-->
<!--binding - 通信方式-->
<!--contract - 服務契約-->
<endpoint address="" binding="wsHttpBinding" contract="WCF.ServiceLib.Security.IHello" bindingConfiguration="SecurityBindingConfiguration" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="SecurityBehavior">
<!--httpGetEnabled - 訓示是否釋出服務中繼資料以便使用 HTTP/GET 請求進行檢索，如果釋出 WSDL，則為 true，否則為 false，預設值為 false-->
<serviceMetadata httpGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true"/>
<serviceCredentials>
<!--userNamePasswordValidationMode - 以使用者名/密碼模式來進行驗證的方法-->
<!--UserNamePasswordValidationMode.Windows - 使用者名映射到 Windows 使用者-->
<!--UserNamePasswordValidationMode.MembershipProvider - 提供基于已配置的 MembershipProvider 的密碼驗證-->
<!--UserNamePasswordValidationMode.Custom - 基于已配置的自定義 UsernamePasswordValidator 的自定義身份驗證-->
<!--customUserNamePasswordValidatorType - 所使用的自定義使用者名密碼驗證程式的類型-->
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="WCF.ServiceLib.Security.CustomNamePasswordValidator, WCF.ServiceLib" />
<!--findValue - 指定要在 X.509 證書存儲區中搜尋的值-->
<!--storeLocation - 指定用戶端可用于驗證伺服器證書的證書存儲區位置（LocalMachine - 配置設定給本地計算機的 X.509 證書存儲區；CurrentUser - 目前使用者使用的 X.509 證書存儲區）-->
<!--storeName - 要打開的 X.509 證書存儲區的名稱（參看：StoreName枚舉。AddressBook, AuthRoot, CertificateAuthority, Disallowed, My, Root, TrustedPeople, TrustedPublisher）-->
<!--x509FindType - 要執行的 X.509 搜尋的類型（參看：X509FindType枚舉）-->
<serviceCertificate findValue="Webabcd" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="SecurityBindingConfiguration">
<security>
<!--clientCredentialType - 用戶端用以進行身份驗證的憑據的類型，預設值 UserName -->
<!--BasicHttpMessageCredentialType.UserName - 使用使用者名憑據對用戶端進行身份驗證-->
<!--BasicHttpMessageCredentialType.Certificate - 使用證書對用戶端進行身份驗證-->
<message clientCredentialType="UserName" />
</security>
</binding>
</wsHttpBinding>
</bindings>
</system.serviceModel>
</configuration>
4、用戶端
Hello.aspx
<%@ Page Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" CodeFile="Hello.aspx.cs"
Inherits="Sample_Security" Title="安全(Security)" %>
<asp:Content ID="Content1" ContentPlaceHolderID="head" runat="Server">
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="Server">
<p>
以使用者名和密碼做驗證，通過X.509證書做加密為例
</p>
<asp:Label ID="lblMsg" runat="server" />
使用者名：<asp:TextBox ID="txtUserName" runat="server" Text="webabcd" />
密碼：<asp:TextBox ID="txtPassword" runat="server" Text="webabcd" />
<asp:TextBox ID="txtName" runat="server" Text="webabcd" />
<asp:Button ID="btnSayHello" runat="server" Text="Hello" OnClick="btnSayHello_Click" />
</asp:Content>
Hello.aspx.cs
using System.Collections;
using System.Configuration;
using System.Data;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
public partial class Sample_Security : System.Web.UI.Page
protected void Page_Load(object sender, EventArgs e)
protected void btnSayHello_Click(object sender, EventArgs e)
using (var proxy = new SecuritySvc.HelloClient())
try
// proxy.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.PeerTrust;
proxy.ClientCredentials.UserName.UserName = txtUserName.Text;
proxy.ClientCredentials.UserName.Password = txtPassword.Text;
lblMsg.Text = proxy.SayHello(txtName.Text);
catch (TimeoutException ex)
lblMsg.Text = ex.ToString();
proxy.Abort();
catch (Exception ex)
<client>
<!--address - 服務位址-->
<!--binding - 通信方式-->
<!--contract - 服務契約-->
<!--bindingConfiguration - 指定相關的綁定配置-->
<endpoint address="http://localhost:3502/ServiceHost/Security/Hello.svc"
binding="wsHttpBinding"
contract="SecuritySvc.IHello"
bindingConfiguration="HelloBindingConfiguration"
behaviorConfiguration="HelloBehaviorConfiguration">
<identity>
<!--encodedValue - 此證書編碼的值。公鑰，用于加密使用者名和密碼。測試時，請根據實際情況修改此值-->
<certificate encodedValue="AwAAAAEAAAAUAAAAwMJESjc9Bbgeh9hIrrdrlMz0nfEgAAAAAQAAALMBAAAwggGvMIIBXaADAgECAhBC+dqPonX5pEwDPMLbdE9MMAkGBSsOAwIdBQAwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3kwHhcNMDgwNzE1MDczODIwWhcNMzkxMjMxMjM1OTU5WjASMRAwDgYDVQQDEwdXZWJhYmNkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwfrBPcMSOWVJmDnn+EFfCOslH0OqC5s67C6e19XQ7oMh6a9hP9Os4hefNoGxcdPK3orV4y4pHn0VOvHgaeAJqreRjmgmyb+h2BDB7nkmhchBxQZUx4jSX0GUrqECZm9uUMrNq8vx7NtaEuEMs5q50KPaxrv6PwuKLssNnb3WC1wIDAQABo0swSTBHBgNVHQEEQDA+gBAS5AktBh0dTwCNYSHcFmRjoRgwFjEUMBIGA1UEAxMLUm9vdCBBZ2VuY3mCEAY3bACqAGSKEc+41KpcNfQwCQYFKw4DAh0FAANBAE/6rAQhU3X1RficEHPEeUAX7HQQXZDYByQt0QqE7C8PaViQWlWU+Sp8u9Oy3ce4DSg3wgQLL/DIknG7FMIiGRE=" />
</identity>
</endpoint>
</client>
<binding name="HelloBindingConfiguration">
<endpointBehaviors>
<behavior name="HelloBehaviorConfiguration">
<clientCredentials>
<serviceCertificate>
<!--authentication - 證書驗證模式 -->
<!--X509CertificateValidationMode.None - 不使用證書驗證-->
<!--X509CertificateValidationMode.PeerTrust - 如果證書位于被信任的人的存儲區中，則有效-->
<!--X509CertificateValidationMode.ChainTrust - 如果該鍊在受信任的根存儲區生成證書頒發機構，則證書有效-->
<!--X509CertificateValidationMode.PeerOrChainTrust -如果證書位于被信任的人的存儲區或該鍊在受信任的根存儲區生成證書頒發機構，則證書有效 -->
<!--X509CertificateValidationMode.Custom -使用者必須插入自定義 X509CertificateValidator 以驗證證書 -->
<authentication certificateValidationMode="PeerTrust" />
</serviceCertificate>
</clientCredentials>
</endpointBehaviors>
運作結果：
單擊"btnSayHello"按鈕，顯示"Hello: webabcd"。經過加密的使用者名和密碼放在SOAP頭中傳輸。
OK
<a href="http://down.51cto.com/data/100781" target="_blank">[源碼下載下傳]</a>
本文轉自webabcd 51CTO部落格，原文連結：http://blog.51cto.com/webabcd/344171，如需轉載請自行聯系原作者
![SIP Presence SUBSCRIBE-NOTIFY[圖]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)