WCF 中基于令牌的身份验证 [英] Token-Based Authentication in WCF
问题描述
我正在创建一个包含 ASP.NET 页面和 Flash 小程序的网站.我想将我的业务逻辑封装在 WCF 服务中，该服务将通过两个端点公开:一个可通过 HTTP(S) 通过 Internet 访问，供 Flash 客户端使用，另一个可在数据中心内访问，供应用程序服务器使用.如果这看起来不是一个好方法，那么请阻止我；否则，我会继续前进...
I am creating a website which will contain both ASP.NET pages and a Flash applet. I want to encapsulate my business logic in a WCF service which will be exposed through two endpoints: One accesssible over the Internet through HTTP(S), for use by the Flash client, and one accessible within the data center for use by the application servers. If this does not seem like a good approach, then stop me here; otherwise, I'll move on...
问题是如何验证来自 Flash 客户端的请求.由于我不想将用户的密码存储在浏览器 cookie 中，不想每次请求都发送密码，也不想在初次登录后使用 HTTPS，我打算使用令牌-基于身份验证的系统.我也不希望用户在已经登录到站点本身后还必须登录 Flash 客户端，因此我计划在 Flash 客户端启动时使用 Javascript 将令牌传递给它.
The question is how to authenticate requests coming from the Flash client. Since I don't want to store the user's password in a browser cookie, don't want to send the password with every request, and don't want to have to use HTTPS after the initial login, I plan on using a token-based authentication system. I also don't want the user to have to log into the Flash client after already logging into the site itself, so I plan on using Javascript to pass the token to the Flash client when it starts.
我知道 WCF 支持使用 .NET Framework 的内置安全框架 (System.Security) 来实施访问控制，我想利用这一点.
I know WCF supports using the .NET Framework's built-in security framework (System.Security) to enforce access control, and I would like to take advantage of this.
那么，问题是:当 Flash 调用 WCF 服务时，如何将令牌传递给 WCF 服务，以及如何在服务器上处理令牌?
- WCF 具有颁发的令牌"身份验证模式，但它似乎旨在用于具有安全令牌服务和 SAML 令牌的成熟的联合方案——我真正想要的有点复杂.可以将这种模式与我自己的简单随机字符串"令牌一起使用吗?如果是这样，如何?请记住，这需要与 Flash 兼容.
- 我可能会在标头(SOAP 标头或 HTTP 标头)中传递令牌.在这种情况下，一旦我确定发出请求的是哪个用户，我该如何通知框架以便 System.Security 检查起作用?
- 我应该考虑完全不同的方法吗?任何避免在每个请求中都发送密码、让我使用 System.Security 并与 Flash 配合使用的东西都是可能的.
推荐答案
看起来原来的问题已经得到解答，我会保持简短，但一种方法确实是在 http 标头中传递身份验证令牌并覆盖自定义 ServiceAuthorizationManager 中的 CheckAccess(OperationContext operationContext, ref Message message) .
As it seems the original question has been answered I'll keep this brief, but one approach would indeed be to pass the authentication token in an http header and override CheckAccess(OperationContext operationContext, ref Message message) in a custom ServiceAuthorizationManager .
您之前已将服务配置为使用实现 IAuthorizationPolicy 的自定义策略.
You will have previously configured the service to use a custom policy that implements IAuthorizationPolicy.
剩下的就是实现简单的 IIdentity 和 IPrincipal 类来存储您的授权状态.
All that remains is to implement simple IIdentity and IPrincipal classes to store your authorization state.
有很多关于这个主题的好文章:
A number of good articles exist on this subject:
http://msdn.microsoft.com/en-us/library/system.identitymodel.policy.iauthorizationpolicy.aspx
http://msdn.microsoft.com/en-us/library/system.servicemodel.serviceauthorizationmanager.aspx
我想这可能仍然感觉像是一个自己动手"的解决方案，但是当您遵循既定的模式时，它至少让人放心.它确实具有将您的授权代码从您的服务方法中黑盒化的优势.
I guess this may still feel like a "roll-your-own" solution, but its at least reassuring when you're following an established pattern. It does have the advantage of black-boxing your authorization code from your service methods.
这篇关于WCF 中基于令牌的身份验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
