如何设置 WorkflowService 身份验证？

Question

我只需要保护我的 WF 服务。找不到这方面的任何资源。怎么做？

已经试过了：

class Program
{
    static void Main(string[] args)
    {
        using (WorkflowServiceHost host = new WorkflowServiceHost(new Workflow1(), new Uri("http://localhost/Test")))
        {
            host.Credentials.UserNameAuthentication.UserNamePasswordValidationMode = System.ServiceModel.Security.UserNamePasswordValidationMode.Custom;
            host.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = new Test();

            host.Open();
            Console.Write("ready");
            Console.ReadLine();
        }
    }
}
public class Test : UserNamePasswordValidator
{
    public Test()
    {
        Console.Write("hit");
    }

    public override void Validate(string userName, string password)
    {
        Console.Write("never hit");
    }
}

还有一个配置

<bindings>
  <wsHttpBinding>
    <binding>
      <security mode="Message">
        <message clientCredentialType="UserName" />
      </security>
    </binding>
  </wsHttpBinding>
</bindings>

  <serviceBehaviors>
    <behavior>
      <serviceMetadata httpGetEnabled="true"/>
      <serviceDebug includeExceptionDetailInFaults="false"/>
      <!--<serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="myAssembly.Test, myAssembly" />
      </serviceCredentials>-->
    </behavior>
  </serviceBehaviors>

• 无法创建固定名称端点，因为它们是动态创建的

更新 - 我尝试了下面的配置并成功了，但我想要一种更精细的方式来设置每个服务使用的绑定

<protocolMapping>
  <add scheme="http" binding="wsHttpBinding"/>
</protocolMapping>

Answer 1

我们有一集 Workflow TV 应该会有所帮助。 Workflow TV - Workflow Services Security

Answer 2

就消息传递部分而言，这只是 WCF，因此您可以使用 WCF 做的任何事情都应该在这里工作。

也就是说，对于工作流程，您通常需要对除第一个请求之外的所有请求进行更细粒度的控制。例如，所有员工都可以开始费用报告，但只有开始特定费用报告的员工才能向其中添加费用并提交。您可以使用WF Security Pack 进行此类安全检查。

Answer 3

有点hackish，但有效。重写 WorkflowServiceHost 以获取未知的合同名称并为每个合同添加服务端点。

    const string DEFAULT_WORKFLOW_SERVICE_BINDING_NAME = "WorkflowDefaultBinding";

    static void Main(string[] args)
    {            
        MyWorkflowServiceHost host = new MyWorkflowServiceHost(new CountingWorkflow2(), new Uri(hostBaseAddress));
        foreach (var contractName in host.ImplementedContractsNames)
        {
            // now I'm able to choose which binding to use depending on a condition
            var binding = new WSHttpBinding(DEFAULT_WORKFLOW_SERVICE_BINDING_NAME);

            host.AddServiceEndpoint(contractName, binding, string.Empty);
        }
    }

还有我的工作流服务主机

    public class MyWorkflowServiceHost : WorkflowServiceHost
    {
        public MyWorkflowServiceHost(Activity activity, params Uri[] baseAddresses)
            : base(activity, baseAddresses)
        {

        }

        private IDictionary<string, System.ServiceModel.Description.ContractDescription> _implementedContracts;
        public IEnumerable<string> ImplementedContractsNames
        {
            get
            {
                foreach (var contract in _implementedContracts)
                    yield return contract.Key;
            }
        }

        protected override System.ServiceModel.Description.ServiceDescription CreateDescription(out System.Collections.Generic.IDictionary<string, System.ServiceModel.Description.ContractDescription> implementedContracts)
        {
            System.ServiceModel.Description.ServiceDescription description = base.CreateDescription(out implementedContracts);

            _implementedContracts = implementedContracts;

            return description;
        }
    }

添加一个未命名的 WSHttpBinding 和以下关于服务模型的部分也应该可以工作，但是对于默认配置

<protocolMapping>
  <add scheme="http" binding="wsHttpBinding"/>
</protocolMapping>