WCF最容易实现的安全模式

Question

What's the easiest security mode for implementation in WCF when:

1. Both client and service are .NET applications.
2. Client and service are negotiating over internet.
3. SSL in not available.
4. Port 80 (web) is preferred for communication.
5. And Using a x 509 certificate should be the last option (same credentials in configuration file at both sides is preferred, if possible)

Answer 1

If you are looking for a way to do username/password authentication, you can use wsHttpBinding and create a custom class that inherits from UsernamePasswordValidator and overrides the Validate method.

Here is an example: http://codebetter.com/petervanooijen/2010/03/22/a-simple-wcf-service-with-username-password-authentication-the-things-they-don-t-tell-you/

Answer 2

The easiest security to implement is a lack of security, though not recommended at all:

<message clientCredentialType="None" />

<transport clientCredentialType="None" />

The next, which actually provides some security, would probably be Windows (see a tutorial on enabling this here ) or Password for transport level security. See here for an MSDN overview of available credential options.

But to be honest there is quite a broad area for you to cover other than just specifying easiest . You can combine Transport and Message security, go with either or, use different credential types and so on - really, the easiest depends on the requirements, which, given point 5 of your question, would seem to reinforce my recommendation of Windows or Password authentication for this scenario.

Answer 3

What do you mean by security ? It is possible to use "security" over Internet without certificates if your security actually only mean username and password (client authentication) and you are happy with plain text messages. If you require any form of encryption and signing you need certificate or you have to build your own solution. (Using Windows security mode is not possible because it works only in the same AD domain or trusted domains.)

WCF itself provides by default only UserName/Password (WS-Security UsernameToken Profile with plain text password) over secured channel (transport or message security). It is possible to use UserName/Password over unsecured channel but in such case you will send plain text password over Internet. UsernameToken Profile also offers digested password - it is not considered secure but it is used very often. WCF doesn't support it but there is some implementation available.

I would go with HTTPS. Why is in not possible?