Question

我一直在努力争取在WCF服务上使用自定义基本身份验证一段时间，我已经搜索了互联网，试图找到一个没有运气的好答案。

我已尝试使用自定义userNameAuthentication以及自定义serviceAuthorizationManager。

我遇到的是我被困在一个＆＃34;循环＆＃34;它要求凭据，似乎永远不会进入我的自定义身份验证。从我的研究来看，似乎是因为IIS正在劫持身份验证并检查本地用户。

从网络配置中，我使用基本身份验证启用了传输安全性：

<webHttpBinding>
    <binding name="SecureBinding">
      <security mode="Transport">
        <transport clientCredentialType="Basic" />
      </security>
    </binding>
  </webHttpBinding>

相关的服务行为:(我有一个我试过注释过的东西）

<serviceBehaviors>
    <behavior name="AuthenticatedWCF.CustomServiceBehavior">
      <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug includeExceptionDetailInFaults="true"/>
      <serviceAuthorization serviceAuthorizationManagerType="AuthenticatedWCF.Classes.Helpers.AuthenticationManager, AuthenticatedWCF" />
      <!--<serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="AuthenticatedWCF.Classes.Helpers.AuthenticationManager, AuthenticatedWCF" />
      </serviceCredentials>-->
    </behavior>
  </serviceBehaviors>

授权类（永远不会被调用）：

public class AuthenticationManager : ServiceAuthorizationManager
{
    protected override bool CheckAccessCore(OperationContext operationContext)
    {
        //Extract the Authorization header, and parse out the credentials converting the Base64 string:
        var authHeader = WebOperationContext.Current.IncomingRequest.Headers["Authorization"];

        if ((authHeader != null) && (authHeader != string.Empty))
        {
            return true;
            /*var svcCredentials = System.Text.ASCIIEncoding.ASCII
                    .GetString(Convert.FromBase64String(authHeader.Substring(6)))
                    .Split(':');

            throw new Exception(authHeader);

            var user = new { Name = svcCredentials[0], Password = svcCredentials[1] };
            if ((user.Name == "user1" && user.Password == "test"))
            {
                //User is authrized and originating call will proceed
                return true;
            }
            else
            {
                //not authorized
                return false;
            }*/
        }
        else
        {
            //No authorization header was provided, so challenge the client to provide before proceeding:
            WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate: Basic realm=AuthenticatedWCF");
            //Throw an exception with the associated HTTP status code equivalent to HTTP status 401
            //throw new WebFaultException("Please provide a username and password", HttpStatusCode.Unauthorized);
            throw new WebFaultException(HttpStatusCode.Unauthorized);
            //return false;
        }
    }
}

我想问题是，如何让IIS成为一个混蛋？

如果您需要更多详情，请与我们联系，我们很乐意与您分享任何问题的答案。

Answer 1

您必须在Web配置中关闭基本身份验证才能调用此类。在您的应用程序被识别之前，IIS将处理基本身份验证。

WCF服务上的自定义基本身份验证

1 个答案: