在 IIS 托管的 WCF 服务中使用 IdentityServer 令牌

Question

我正在尝试在 IIS 托管的 WCF 服务中使用（使用）IdentityServer 令牌。 我已经看到了 Dominick 的自托管 WCF 服务示例。 但由于我的 WCF 服务托管在 IIS 中，我需要在 web.config 文件中配置绑定和身份服务器配置选项。 任何人都可以与 IdentityServer 配置共享 web.config 文件吗？ 请在下面找到我当前的配置：

<?xml version="1.0"?>
<configuration>
<appSettings>
<add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
</appSettings>
<system.web>
<compilation debug="true" targetFramework="4.5.2" />
<httpRuntime targetFramework="4.5.2"/>
</system.web>
<system.serviceModel>
<bindings>
  <ws2007FederationHttpBinding>
    <binding name="WS2007FederationHttpBinding_IService1">
      <security mode="TransportWithMessageCredential">
        <message establishSecurityContext="false" issuedKeyType="BearerKey">
          <issuer address="https://localhost/dentityServer" />
        </message>
      </security>
    </binding>
  </ws2007FederationHttpBinding>
</bindings>
<client>
  <endpoint address="https://localhost/IDPWcfService1/Service1.svc" 
            binding="ws2007FederationHttpBinding" bindingConfiguration="WS2007FederationHttpBinding_IService1"
            contract="WcfService1.IService1" name="WS2007FederationHttpBinding_IService1" ></endpoint>
</client>
<behaviors>
  <serviceBehaviors>
    <behavior>
      <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug includeExceptionDetailInFaults="false"/>
    </behavior>
  </serviceBehaviors>
</behaviors>
<protocolMapping>
    <add binding="basicHttpsBinding" scheme="https" />
</protocolMapping>    
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
<!--
    To browse web app root directory during debugging, set the value below to true.
    Set to false before deployment to avoid disclosing web app folder information.
  -->
<directoryBrowse enabled="true"/>
</system.webServer>

</configuration>

Answer 1

我在这里做同样的事情，您需要添加您的自定义 XML 包装类来封装 JWT（这只是将在每次来自客户端的调用时传递给服务的安全令牌，以便您可以对客户端进行身份验证）

您可以在本文中找到更多详细信息： https : //leastprivilege.com/2015/07/02/give-your-wcf-security-architecture-a-makeover-with-identityserver3/

完成此步骤后，您需要将此自定义 xml 包装器添加到 web.config 中，如下所示：

  <system.identityModel>
    <identityConfiguration saveBootstrapContext="true">
      <securityTokenHandlers>
        <remove type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=abcdefg123456789"/>        
        <add type="Web.stuff.ServerSideAuthentication.IdentityServerWrappedJwtHandler, Web.stuff" />
      </securityTokenHandlers>
    </identityConfiguration>
  </system.identityModel>

另外不要忘记在 configsections 节点下为这个新部分添加一个声明。