指定用于WCF身份验证的凭据

Question

I have a WinForms + WCF + SQL application which I'm trying to secure using the built-in WCF security capabilities.

I am in a position where I need to use UserName security so on the client side I understand that any time I create a proxy or a channel, I'll need to specify the ClientCredentials .

Currently the WCF calls are made like this throughout the client:

private void button1_Click(System.Object sender, System.EventArgs e)
{
    ServiceReference1.Service1Client client = new
        ServiceReference1.Service1Client();
    string returnString;

    returnString = client.GetData(textBox1.Text);
    label1.Text = returnString;
}

What would the best approach here be? Should I go through every instantiation of the proxy in the client code and set the ClientCredentials property? The alternative I've thought of is specifying the credentials once in a ChannelFactory and passing the ChannelFactory around the application. Both methods seem to require a lot of rework or duplication which makes me feel like I'm being oblivious to something.

Answer 1

You can implement IClientMessageInspector to include user credential on each outgoing message.

public class ClientMessageInspector : IClientMessageInspector
    {
        public object BeforeSendRequest(ref Message request, IClientChannel channel)
        {
            var credHeader = new YourCustomHeader
            {
                UserName = "UserName",
                Password = "Password"
            };

            var typedHeader = new MessageHeader<CustomHeader>(credHeader);
            var untypedHeader = typedHeader.GetUntypedHeader("custom-header", "s");

            request.Headers.Add(untypedHeader);
            return null;
        }

        public void AfterReceiveReply(ref Message reply, object correlationState)
        {
            //
        }
    }

IClientMessageInspector Interface

Accessing clientcredential properties from client message inspector

Creating Custom WCF Endpoint Behavior

Consuming a web service using digest authentication