保持HTTP基本身份认证活着而被重定向 [英] Keeping HTTP Basic Authentification alive while being redirected

问题描述

我们正在使用基本身份验证的Web服务。
它的所有工作都很好，直到Web服务的业主实现平衡服务。
这简直是将请求重定向到网络服务的不同实例。

的问题是，被重定向后，基本验证失败。
有请求验证凭据没有被通过例外

附加信息：

1. 我们必须手动创建要求。

     VAR REQ =（HttpWebRequest的）WebRequest.CreateDefault（新的URI（Settings.Default.HpsmServiceAddress））; 
    
    req.Headers.Add（授权，基本AAAAAAAAAAA）; 
    req.PreAuthenticate = TRUE; 
    req.AuthenticationLevel = AuthenticationLevel.MutualAuthRequested; 
    req.UserAgent =Apache的HttpClient的/ 4.1.1（Java 1.5中）; 
    req.KeepAlive = FALSE; 
    
    ServicePointManager.Expect100Continue = FALSE; 
    
    req.ContentType =文本/ XML的，字符集= UTF-8; 
    req.Method =POST; 
    req.Accept =gzip的，放气; 
    req.Headers.Add（SOAPAction报，actionName）; 
   字节[]缓冲= Encoding.UTF8.GetBytes（信封）; 
   流STM = req.GetRequestStream（）; 
    stm.Write（缓冲液，0，buffer.Length）; 
    stm.Close（）; 
    
    WebResponse的响应= req.GetResponse（）; 
   串strResponse =新的StreamReader（response.GetResponseStream（））为ReadToEnd（）。 
    response.Dispose（）; 
     




2. 我们重定向与HTTP 307重定向

解决方案

遵循HttpWebRequest.AllowAutoRedirect物业我发现这个MSDN：

授权头是在自动重定向清零并
HttpWebRequest的自动尝试重新进行身份验证到
重定向的位置。在实践中，这意味着应用程序不能
将自定义的验证信息到Authorization头，如果
就有可能遇到重定向。相反，应用程序必须
实现并注册自定义的验证模块。在
System.Net.AuthenticationManager及相关类用于
实现自定义的验证模块。在
AuthenticationManager.Register方法注册一个自定义
认证模块。

解决方法是编写自定义验证模块。

下面是我已经找到它：

的 http://msdn.microsoft.com/en-us/library/system.net.authenticationmanager.aspx

和这里的AllowAutoRedirect属性页：

的 http://msdn.microsoft.com/en-us/library/system.net.httpwebrequest.allowautoredirect.aspx

更新

您可以尝试使用CredentialCache代替加上头的WebRequest？

  CredentialCache myCache =新CredentialCache（）; 
 
 myCache.Add（
新的URI（http://www.contoso.com/），基本，新的NetworkCredential（用户名，SecurelyStoredPassword））; 
 req.Credentials = myCache; 
  

We are using web service with basic authentication. It all worked all fine, till owners of web service implemented balancing service. Which is simply redirects requests to different instances of web service.

The problem is that after being redirected basic authentication fails. There is "request authentication credentials was not passed" exception.

Additional info:

1. We have to create request manually.

       var req = (HttpWebRequest)WebRequest.CreateDefault(new Uri(Settings.Default.HpsmServiceAddress));
   
       req.Headers.Add("Authorization", "Basic aaaaaaaaaaa");
       req.PreAuthenticate = true;
       req.AuthenticationLevel = AuthenticationLevel.MutualAuthRequested;
       req.UserAgent = "Apache-HttpClient/4.1.1 (java 1.5)";
       req.KeepAlive = false;
   
       ServicePointManager.Expect100Continue = false;
   
       req.ContentType = "text/xml; charset=utf-8";
       req.Method = "POST";
       req.Accept = "gzip,deflate";
       req.Headers.Add("SOAPAction", actionName);
       byte[] buffer = Encoding.UTF8.GetBytes(envelop);
       Stream stm = req.GetRequestStream();
       stm.Write(buffer, 0, buffer.Length);
       stm.Close();
   
       WebResponse response = req.GetResponse();
       string strResponse = new StreamReader(response.GetResponseStream()).ReadToEnd();
       response.Dispose();
   

2. We are redirected with HTTP 307 redirect

解决方案

Follow the MSDN for HttpWebRequest.AllowAutoRedirect Property i found this :

The Authorization header is cleared on auto-redirects and HttpWebRequest automatically tries to re-authenticate to the redirected location. In practice, this means that an application can't put custom authentication information into the Authorization header if it is possible to encounter redirection. Instead, the application must implement and register a custom authentication module. The System.Net.AuthenticationManager and related class are used to implement a custom authentication module. The AuthenticationManager.Register method registers a custom authentication module.

Solution is to write a custom Authentication Module.

Here what i've found about it :

http://msdn.microsoft.com/en-us/library/system.net.authenticationmanager.aspx

And here the AllowAutoRedirect properties page :

http://msdn.microsoft.com/en-us/library/system.net.httpwebrequest.allowautoredirect.aspx

UPDATE

Can you try to use CredentialCache instead of add header to webrequest ?

CredentialCache myCache = new CredentialCache();

myCache.Add(
new Uri("http://www.contoso.com/"),"Basic",new NetworkCredential(UserName,SecurelyStoredPassword));
req.Credentials = myCache;

这篇关于保持HTTP基本身份认证活着而被重定向的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！