WCF 中未调用自定义用户/密码验证

Question

I'm working on a WCF webservice. I add a custom user / password validation, but my method is not called.

I created a new class in App_Code:

public class Connexion : System.IdentityModel.Selectors.UserNamePasswordValidator
{
    public override void Validate(string userName, string password)
    {
        string Result = CsGeneral.Instance.RequeteScalar<string>(string.Format("select IdUser from usr.User where IdUser = '{0}' and Password = '{1}'", userName.Replace("'", "''"), CsGeneral.Instance.Crypt(password)));
        if (string.IsNullOrWhiteSpace(Result)) throw new FaultException("Login et/ou mot de passe invalide");
    }
}

And I changed my web.config to call this method:

<system.serviceModel>
<bindings>
  <wsHttpBinding>
    <binding name="SSL_WcfBijoux" bypassProxyOnLocal="true" maxBufferPoolSize="524288000"
      maxReceivedMessageSize="655360000">
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName" />
      </security>
    </binding>
  </wsHttpBinding>
</bindings>
<services>
  <service behaviorConfiguration="BhvBijoux" name="Bijoux">
    <endpoint address="" binding="wsHttpBinding" bindingConfiguration="SSL_WcfBijoux" contract="IBijoux" />
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="">
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="false" />
    </behavior>
    <behavior name="BhvBijoux">
      <serviceDebug httpHelpPageEnabled="true" includeExceptionDetailInFaults="true" />
      <serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" />
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom"
          customUserNamePasswordValidatorType="WsLogebi.Connexion, App_Code" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>
<protocolMapping>
    <add binding="basicHttpsBinding" scheme="https" />
</protocolMapping>    
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />

</system.serviceModel>

I add a break point in the Validate method, but I can call my webservice method over my https URL without passing this method...

What am I doing wrong?

Thank you in advance !!!!

Answer 1

First of all, you have to check what binding is used by the client. In your configuration file, I see two bindings, one is wsHttpBinding and the other is basicHttpsBinding. If the client uses basicHttpsBinding, custom authentication is useless. I suggest that you can delete protocolMapping before testing. Here is my demo:

<system.serviceModel>
    <services>
      <service name="Microsoft.Samples.UserNamePasswordValidator.CalculatorService" behaviorConfiguration="CalculatorServiceBehavior">
        <host>
          <baseAddresses>
            <!-- configure base address for host -->
            <add baseAddress="http://localhost:8001/servicemodelsamples/service"/>
          </baseAddresses>
        </host>
        <!-- use base address provided by host, provide one endpoint -->
        <endpoint address="username" binding="wsHttpBinding" bindingConfiguration="Binding1" contract="Microsoft.Samples.UserNamePasswordValidator.ICalculator"/>
      </service>
    </services>

    <bindings>
      <wsHttpBinding>
        <!-- Username binding -->
        <binding name="Binding1">
          <security mode="Message">
              <message clientCredentialType="UserName"/>
          </security>
        </binding>        
      </wsHttpBinding>
    </bindings>

    <behaviors>
      <serviceBehaviors>
        <behavior name="CalculatorServiceBehavior" includeExceptionDetailInFaults="True">
          <serviceCredentials>
            <!-- 
            The serviceCredentials behavior allows one to specify a custom validator for username/password combinations.                  
            -->
            <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Microsoft.Samples.UserNamePasswordValidator.CalculatorService+CustomUserNameValidator, service"/>
            <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName"/>
          
          </serviceCredentials>        
        </behavior>
      </serviceBehaviors>
    </behaviors>
    
  </system.serviceModel>

This is the configuration file, you can also try to set the value of mode to message.

public class CustomUserNameValidator : System.IdentityModel.Selectors.UserNamePasswordValidator
        {   
            public override void Validate(string userName, string password)
            {
                if (null == userName || null == password)
                {
                    throw new ArgumentNullException();
                }

                if (!(userName == "test1" && password == "1tset") && !(userName == "test2" && password == "2tset"))
                {
                    throw new FaultException("Unknown Username or Incorrect Password");
                }
            }
        }

This is a custom verification class.

Answer 2

Thank you for your answer.

Finnaly, I find it !

It was in my service declaration, I had to use:

  <service name="WsLogebi.Bijoux" behaviorConfiguration="TreizOr_Behavior">
    <endpoint address=""
              binding="wsHttpBinding"
              bindingConfiguration="secureHttpBinding"
              contract="WsLogebi.IBijoux"/>
  </service>

And the customnamevalidator was incorrect. I had to write the complete class name with namespace, and the folder and the file where it was.

customUserNamePasswordValidatorType="WsLogebi.App_Code.Authentification.Connexion, App_Code/Connexion"