WCF：如何以无效方法验证凭据？

Question

I want to use my Self Hosted WCF Service with Credentials, so I watched a few tutorials how to do it and I came to the solution to inherit from the "UserNamePasswordValidator" class and override the Validate method. This class i can set in my App.config:

public class UNValidator : UserNamePasswordValidator
  {
    public UNValidator() : base()
    {
    }
    public override void Validate(string userName, string password)
    {
      if (userName == "user" && password == "secret")
         return;

      throw new System.IdentityModel.Tokens.SecurityTokenException(
                "Unknown Username or Password");
    }
  }

The Validate method is a void!? I use the WCF Service in my server application, when someone who wants to log in and makes a typo the server will crash. How I can decline a wrong User log in without throwing an exception?

Any help appreciated.

Answer 1

With my own experience building web portals, I do not use a custom UserNamePasswordValidator method to validate users but I create an application key/password and validate it instead.

After that I have my own authentication service (in my case i'm authenticating AD users) and I thrown exceptions if the credentials don't match. With these scenario you have full control on your exceptions and you can handle them as you wish.

If I were you I would do the following:

• Create a pair app_key/app_secret and place them in front end/services web.config(assuming this is secure in the server), so you can use your custom password validator, this makes sure no other application is using your service layer.
• Create a Web service for authentication only, where you validate your user, create tokens that will be passed to the session on front end. Here you have full power to do what you want.

Answer 2

I found the solution by try and error.

Its simpler as i thought, just abort the Thread:

public override void Validate(string userName, string password)
{
    if (userName == "test" && password == "test")        
        return;

    System.Threading.Thread.CurrentThread.Abort();
}

If the thread is aborted, the client gets an error "403: Unauthorized" and the server application keeps running.

Answer 3

Use a try/catch block to handle the exception when calling the method.

try
{
    //Logging in.
    var validator = new UNValidator();
    validator.Validate(username, password);
    //Anything written past this point means your login was successful.
}
catch
{
 //Catch the exception here, which means invalid login.
}