WCF服务中的ASP.NET成员身份验证

Question

I am trying to extend an existing ASP.NET application with a WCF service. The service must require authentication via the same Membership Provider that the rest of the site uses.

Here's the web.config file:

<configuration>
<system.web>
  <compilation debug="true" targetFramework="4.5.2" />
  <httpRuntime targetFramework="4.5.2" />
  <authentication mode="Forms">
    <forms name=".MyAppAuthentication" timeout="5760" slidingExpiration="true" />
  </authentication>
  <roleManager enabled="true" defaultProvider="AspNetSqlRoleProvider">
    <providers>
      <clear />
      <add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="UsersContext" applicationName="MyApp" />
    </providers>
  </roleManager>
  <membership defaultProvider="AspNetSqlMembershipProvider">
    <providers>
      <clear/>
      <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="UsersContext" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="10" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="MyApp"/>
    </providers>
  </membership>
</system.web>
<system.serviceModel>
  <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
  <bindings>
    <wsHttpBinding>
      <binding name="MembershipBinding">
        <security mode="TransportWithMessageCredential">
          <transport clientCredentialType="None" />
          <message clientCredentialType="UserName"/>
        </security>
      </binding>
    </wsHttpBinding>
  </bindings>
  <behaviors>
    <serviceBehaviors>
      <behavior name="MembershipBehaviour">
        <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
        <serviceDebug includeExceptionDetailInFaults="false"/>
        <serviceAuthorization roleProviderName="AspNetSqlRoleProvider" principalPermissionMode="UseAspNetRoles" />
        <serviceCredentials>
          <userNameAuthentication userNamePasswordValidationMode="MembershipProvider" membershipProviderName="AspNetSqlMembershipProvider" />
        </serviceCredentials>
      </behavior>
    </serviceBehaviors>
  </behaviors>
  <services>
    <service name="ServiceTestBackend.Services.TestService" behaviorConfiguration="MembershipBehaviour">
      <endpoint address="" binding="wsHttpBinding" bindingConfiguration="MembershipBinding" contract="ServiceTestBackend.Services.ITestService" />
    </service>
  </services>
</system.serviceModel>
<connectionStrings>
  <add name="UsersContext" connectionString="data source=.;initial catalog=MyApp.Accounts;integrated security=True;MultipleActiveResultSets=True;App=EntityFramework" providerName="System.Data.SqlClient" />
</connectionStrings>
</configuration>

The code of the service is very simple:

public class TestService : ITestService
{
    public string FindUser()
    {
        var user = Membership.GetUser();
        return user.UserName;
    }
}

And the client is just about as simple

var client = new TestService.TestServiceClient();
client.ClientCredentials.UserName.UserName = "username";
client.ClientCredentials.UserName.Password = "password";
var acc = client.FindUser();

The server is invoked, but the method fails because Membership.GetUser() returns null .

Am I missing anything in the configuration?

Answer 1

I think there is some confusion here. I am not sure what you want to do exactly. You can make this really simple by doing this.

  public class TestService : ITestService
  {
     public string FindUser(string userName, string password)
     {
        var user = Membership.GetUser(username, password);
        return (user!=null?user.userName: string.Empty);
     }
 }

Your client should look like;

 using(var client = new TestService.TestServiceClient())
 {
     var response = client.FindUser(username, password);
     //validate the response
 }

Answer 2

• Try code like this :

public string FindUser()
{
   if (ServiceSecurityContext.Current != null)
       return ServiceSecurityContext.Current.PrimaryIdentity.Name;
   return null;
}

• You may as well get user name from :

IPrincipal principal = Thread.CurrentPrincipal;
String user = principal.Identity.Name

• And last if you really want to get name from HttContext.Current.User or Membership.GetUser() - because you ve got much existing code - you may write Custom Module for Authentication :

Look at my post : https://stackoverflow.com/a/33523683/5295797
And read carefully section Implementation of the module.
There is also the full project that can be downloaded from a link in that post.

Regards