调用WCF安全请求而不在代码中指定我的凭据

Question

I have REST WCF service with windows authentication.

 <service name="MyService">
    <endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsHttp_Reliable" contract="ISomeService">
      <identity>
        <dns value="localhost" />
      </identity>
    </endpoint>
    <endpoint address="web" behaviorConfiguration="restBehavior" binding="webHttpBinding" bindingConfiguration="web_authenticate_binding" name="computersWebEndpoint" contract="ISomeService" />
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />

  </service>

and the web_authenticate_binding is:

 <binding name="web_authenticate_binding" maxReceivedMessageSize="2147483647">
      <security mode ="TransportCredentialOnly">
        <transport clientCredentialType ="Windows"/>
      </security>
      <readerQuotas maxDepth="128" maxStringContentLength="2147483647" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
      <!--<security mode="TransportCredentialOnly">
        <transport clientCredentialType="Windows"></transport>
      </security>-->
    </binding>

now I want to invoke the service from javascript with the service URL without to write my credentials explicitly in code ( if I will need to fill it in pop up once like when I write the url in the browser that is ok...).

is there is a way to do it?

when invoking the service in the "soap" way by adding service reference it is magically even not asking to my credentials... I want the same "magic" to happen when I invoke the service from javascript in ajax call with the service url... someone know how to do it?

Answer 1

If the service allows anonymous requests then you can request the data anonymously. Otherwise there is no other option then to provide your username/password in the code/config file.

Another option is that you'd implement a security token. (Using STS etc.) Or you could, of course, always omit uploading your config file/ cs file to TFS that contains your secure information.

Answer 2

You are using Windows authentication already. All you need to allow Impersonation in WCF service to validate identity of your user in service.

WCF service code can make calls by using the security identity of the service (usually the host process identity or the identity of a service account), or by using the security identity of the original caller. The original caller may be an ASP.NET service account, or it may be the end user of the client application. You impersonate the original caller whenever downstream code needs to authorize based on the original caller's identity.

In your case it's straight forward ActiveDirectory/windows user.

How to do it

• Step 1: Create a Sample WCF Service
• Step 2: Configure the WCF Service to Use Windows Authentication
• Step 3: Configure the SPN Identity for the WCF Service Endpoint
• Step 4: Implement Impersonation in the WCF Service
• Step 5: Create a Web Application Test Client
• Step 6: Add a WCF Service Reference to the Client
• Step 7: Impersonate the Original Caller When Calling the WCF Service
• Step 8: Configure the Web Application for Constrained Delegation
• Step 9: Test the Client and WCF Service

I think you have already covered step 1 & step 2.

For step3:

Modify web config for service as:

• set binding="wsHttpBinding"

• in identity section, set servicePrincipalName value= HOST/<YourMachineName> & dns value="" instead of localhost. for example:

  ... ...

Step 4: Implement Impersonation in the WCF Service

• Add a using statement for the System.Security.Principal namespace.

• Set the impersonation required on the operation implementation of the specific operation as follows:

  [OperationBehavior(Impersonation = ImpersonationOption.Required)] public string OpertaionFunction(int value) { ... }

Step 5 is for test, so I am skipping that.

Step 6: Add a WCF Service Reference to the Client

• Right-click your client project and then click Add Service Reference.

Step 7: Impersonate the Original Caller When Calling the WCF Service

• Add a using statement for the System.Security.Principle namespace.

• Use the Impersonate() method to impersonate the original caller. Like:

  using System.Security.Principal; protected void YourOperation() { // Obtain the authenticated user's Identity and impersonate the original caller using (((WindowsIdentity)HttpContext.Current.User.Identity).Impersonate()) { WCFTestService.ServiceClient myService = new WCFTestService.ServiceClient(); Response.Write(myService.GetData(123) + "<br/>"); myService.Close(); } }

Step Configure the Web Application for Constrained Delegation

• Start the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in.

• In the left pane of the MMC snap-in, click the Computers node.

• In the right pane, double-click your Web server computer to display the Properties dialog box.

• On the Delegation tab of the Properties window for the Web server computer, Do not trust the computer for delegation is selected by default. To use constrained delegation, select Trust this computer for delegation to specified services only.

• You specify precisely which service or services can be accessed in the bottom pane. Beneath Trust this computer for delegation to specified services only, select Use Kerberos only.

• Click Add.

• The Add Services dialog box appears. Click Users or computers.

• In the Select Users or Computers dialog box, type the name of your WCF service computer if you are running using Network Service. Alternatively, if you are running WCF by using a custom domain account, enter that account name instead. Click OK.

• You will see all the SPNs configured for the selected user or computer account. To restrict access to the WCF service, select the HOST service, and then click OK.

Refer : How to: Impersonate the Original Caller in WCF Calling from a Web Application for more details.

Update for comment :

You can call your wcf service from javascript(jQuery) using ajax call like:

$.ajax({
            type: "POST",//default GET, if you wish leave you can also use GET
            url: "http://localhost/Service.svc/ServiceMethod",
            data: JSON.stringify(AnyJsonInput),
            contentType: 'application/json; charset=utf-8',
            dataType: "json",
            success: function(){//on success},
            error: function(){console.log('error in service')}
        });

NOTE : Once Impersonation in above steps is done, in IE it will automatically take windows credentials from which user is logged on. For other browser also, you need not to do anything, it will automatically ask for username & password.

Just to summarize what we all have done is to automatically pass windows credentials for service for authorization. One important thing is that your website also must be using impersonation