[英]Custom Basic Authentication on WCF Service
我一直在努力让自定义基本身份验证在WCF服务上运行一段时间,我已经搜索了互联网,试图找到一个没有运气的好答案。
我尝试过使用自定义userNameAuthentication以及自定义serviceAuthorizationManager。
我遇到的是,我陷入了它要求凭据的“循环”中,它似乎永远不会进入我的自定义身份验证。 从我的研究来看,似乎是因为IIS正在劫持身份验证并检查本地用户。
从Web配置,我启用了基本身份验证的传输安全性:
<webHttpBinding>
<binding name="SecureBinding">
<security mode="Transport">
<transport clientCredentialType="Basic" />
</security>
</binding>
</webHttpBinding>
相关的服务行为:(我有一个我试过注释过的东西)
<serviceBehaviors>
<behavior name="AuthenticatedWCF.CustomServiceBehavior">
<!-- To avoid disclosing metadata information, set the values below to false before deployment -->
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
<!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="true"/>
<serviceAuthorization serviceAuthorizationManagerType="AuthenticatedWCF.Classes.Helpers.AuthenticationManager, AuthenticatedWCF" />
<!--<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="AuthenticatedWCF.Classes.Helpers.AuthenticationManager, AuthenticatedWCF" />
</serviceCredentials>-->
</behavior>
</serviceBehaviors>
授权类(永远不会被调用):
public class AuthenticationManager : ServiceAuthorizationManager
{
protected override bool CheckAccessCore(OperationContext operationContext)
{
//Extract the Authorization header, and parse out the credentials converting the Base64 string:
var authHeader = WebOperationContext.Current.IncomingRequest.Headers["Authorization"];
if ((authHeader != null) && (authHeader != string.Empty))
{
return true;
/*var svcCredentials = System.Text.ASCIIEncoding.ASCII
.GetString(Convert.FromBase64String(authHeader.Substring(6)))
.Split(':');
throw new Exception(authHeader);
var user = new { Name = svcCredentials[0], Password = svcCredentials[1] };
if ((user.Name == "user1" && user.Password == "test"))
{
//User is authrized and originating call will proceed
return true;
}
else
{
//not authorized
return false;
}*/
}
else
{
//No authorization header was provided, so challenge the client to provide before proceeding:
WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate: Basic realm=AuthenticatedWCF");
//Throw an exception with the associated HTTP status code equivalent to HTTP status 401
//throw new WebFaultException("Please provide a username and password", HttpStatusCode.Unauthorized);
throw new WebFaultException(HttpStatusCode.Unauthorized);
//return false;
}
}
}
我想问题是,我如何绕过IIS成为一个混蛋?
如果您需要更多详细信息,请告诉我,我很乐意与您分享您可能遇到的任何问题的答案。
您必须在Web配置中关闭基本身份验证才能调用此类。 在您的应用程序被识别之前,IIS将处理基本身份验证。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.