使用 basicHttpBinding 和自定义 UserNamePasswordValidator 的 WCF 身份验证？答案

【问题标题】：WCF Authentication using basicHttpBinding and custom UserNamePasswordValidator?使用 basicHttpBinding 和自定义 UserNamePasswordValidator 的 WCF 身份验证？
【发布时间】：2012-10-24 23:14:46
【问题描述】：

这里我在 WCF RESTfull 服务中实现自定义 usernamepasswordvalidator。我需要的是在通过 Chrome REST 客户端调用http://localhost:12229/RestServiceImpl.svc/GetStudentObj 时，它没有验证用户名密码。它直接调用此方法并获取结果。什么是我在这里做错了吗？？

我的界面

 [ServiceContract]
    public interface IRestServiceImpl
    {
        [OperationContract]
        [WebInvoke(Method = "GET", UriTemplate = "/GetStudentObj", RequestFormat = WebMessageFormat.Json,
           ResponseFormat = WebMessageFormat.Json)]
        Student GetStudent();
    }

SVC

public class RestServiceImpl : IRestServiceImpl
    {
        public Student GetStudent()
        {
                Student stdObj = new Student
                {
                    StudentName = "Foo",
                    Age = 29,
                    Mark = 95
                };
                return stdObj;

        }

        public class CustomUserNameValidator : UserNamePasswordValidator
        {
           public override void Validate(string userName, string password)
            {

                if (null == userName || null == password)
                {
                    throw new ArgumentNullException("You must provide both the username and password to access this service");
                }

                if (!(userName == "user1" && password == "test") && !(userName == "user2" && password == "test"))
                {

                     throw new SecurityTokenException("Unknown Username or Incorrect Password");
                }
            }
        }

    }

和 Web.Config

 <system.serviceModel>
    <bindings>
      <webHttpBinding>
        <binding name="webHttpTransportSecurity">
          <security mode="Transport">
            <transport clientCredentialType="Basic"></transport>
          </security>
        </binding>
      </webHttpBinding>
    </bindings>
    <protocolMapping>
      <add scheme="http" binding="webHttpBinding"/>
    </protocolMapping>
    <services>
      <service name="RestService.RestServiceImpl" >
        <endpoint address="" binding="webHttpBinding" contract="RestService.IRestServiceImpl"></endpoint>
      </service>
    </services>
    <behaviors>
      <endpointBehaviors>
        <behavior>
          <webHttp />
        </behavior >
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="SecureRESTSvcTestBehavior">
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="false"/>
          <serviceCredentials>
            <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="RESTfulSecuritySH.CustomUserNameValidator, RESTfulSecuritySH" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>

有什么建议吗？？

【问题讨论】：

被否决 - 你说你想使用 BasicHTTPBinding 但你正在使用 wsHttpBinding。

标签： c# wcf wcf-security basichttpbinding

【解决方案1】：

您似乎没有为您的服务设置自定义行为。

您需要使用 behaviorConfiguration 属性告诉服务您的 SecureRESTSvcTestBehavior 行为：

<service name="RestService.RestServiceImpl" behaviorConfiguration="SecureRESTSvcTestBehavior">
    <endpoint address="" binding="webHttpBinding" contract="RestService.IRestServiceImpl"></endpoint>
</service>

【讨论】：