Question

我正在开发一个WCF REST服务，该服务将托管在Azure中，并希望检查用户ID。为此，我创建了一个自定义ServiceAuthorizationManager。

namespace SecureService
{
    public class AccessControlServiceAuthorizationManager : ServiceAuthorizationManager 
    {
        String serviceNamespace      = String.Empty;
        String acsHostname           = String.Empty;
        String trustedTokenPolicyKey = String.Empty;
        String trustedAudience       = String.Empty;

        public AccessControlServiceAuthorizationManager()
        {
            try
            {
                serviceNamespace      = RoleEnvironment.GetConfigurationSettingValue("serviceNamespace");
                acsHostname           = RoleEnvironment.GetConfigurationSettingValue("acsHostname");
                trustedTokenPolicyKey = RoleEnvironment.GetConfigurationSettingValue("trustedTokenPolicyKey");
                trustedAudience       = RoleEnvironment.GetConfigurationSettingValue("trustedAudience");
            }
            catch
            {
                GenerateErrorResponse();
            }
            finally
            {

            }
        }                                   // end AccessControlServiceAuthorizationManager() Constructor

        protected override bool CheckAccessCore(OperationContext operationContext)
        {
            String headerValue = WebOperationContext.Current.IncomingRequest.Headers[HttpRequestHeader.Authorization];
            String token = String.Empty;
            string[] nameValuePair = null;
            TokenValidator validator = null;


            if (String.IsNullOrEmpty(headerValue))
            {
                GenerateErrorResponse();
                return false;
            }

            if (!headerValue.StartsWith("WRAP "))
            {
                GenerateErrorResponse();
                return false;
            }

            nameValuePair = headerValue.Substring("WRAP ".Length).Split(new char[] { '=' }, 2);

            if (nameValuePair.Length != 2 || 
                nameValuePair[0] != "access_token" || 
                !nameValuePair[1].StartsWith("\"") || 
                !nameValuePair[1].EndsWith("\""))
            {
                GenerateErrorResponse();
                return false;
            }

            token     = nameValuePair[1].Substring(1, nameValuePair[1].Length - 2);
            validator = new TokenValidator(acsHostname, serviceNamespace, trustedAudience, trustedTokenPolicyKey);

            if (!validator.Validate(token))
            {
                GenerateErrorResponse();
                return false;
            }

            return true;
        }

        public void GenerateErrorResponse()
        {

        }
    }
}

我的Web.config如下;

<system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true"/>
    <behaviors>
        <serviceBehaviors>
            <behavior name="Secure">
                <serviceAuthorization serviceAuthorizationManagerType="SecureService.AccessControlServiceAuthorizationManager" />
            </behavior>
        </serviceBehaviors>
        <endpointBehaviors>
            <behavior name="webBehavior">                       
                <webHttp />
            </behavior>
        </endpointBehaviors>
    </behaviors>
    <services>
        <service name="SecureService.Demo">
            <endpoint address="" behaviorConfiguration="webBehavior" binding="webHttpBinding" bindingConfiguration="" contract="SecureService.IDemo" />
            <endpoint address="rest" behaviorConfiguration="webBehavior" binding="webHttpBinding" bindingConfiguration="" contract="SecureService.IDemo" />
        </service>
    </services>
</system.serviceModel>
<system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
        <add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
    </modules>
</system.webServer>

但是，当我通过IE调用服务时，似乎没有调用CheckAccessCore（）方法。所以问题是如何确保调用它，从而确保我的用户得到验证。

我在CheckAccessCore中设置了一个断点，它似乎永远不会被击中。

只是为了让事情变得非常有趣 - 我需要在Silverlight中调用这个web服务。

提前致谢

Answer 1

按照上面粘贴的配置，我发现错过了服务行为“安全”以应用于服务。请检查一下，如果它不是拼写错误...

Answer 2

忽略配置中的'服务'部分。尝试：

<standardEndpoints>
  <webHttpEndpoint>
    <standardEndpoint crossDomainScriptAccessEnabled="True" automaticFormatSelectionEnabled="true" helpEnabled="True"/>
  </webHttpEndpoint>
</standardEndpoints>

CheckAccessCore未在自定义ServiceAuthorizationManager中调用

2 个答案: