Question

我有一个客户端（可能是C＃或PHP）需要能够从我的STS（Thinktecture Identity Server）请求OAuth 2.0访问令牌（兼容JWT），然后将该令牌发送到webhttp端点WCF服务。该服务将在消息检查器中验证令牌，并抛出错误或继续使用服务方法。我正在使用Thinktecture Identity Model和RestSharp来发送休息请求。

到目前为止，我所拥有的是：

客户：

var client = new OAuth2Client(
                new Uri("https://mysts/issue/oauth2/token"),
                "client",
                "secret");

            var response = client.RequestAccessTokenUserName("username", "password", "http://localhost:51696/");

            var token = response.AccessToken;               
            var restClient = new RestClient("https://127.0.0.1:444/");

            var restRequest = new RestRequest(Method.POST);
            restRequest.AddHeader("Authorization", token);
            restRequest.AddObject(new Request());

我从sts获得访问令牌就好了，我不确定我是否正确地在授权头中插入令牌。

消息检查员：

public object AfterReceiveRequest(ref Message request, IClientChannel channel, InstanceContext instanceContext)
    {
        #region new code

         string binding = OperationContext.Current.EndpointDispatcher.ChannelDispatcher.BindingName;
         if (binding == "http://tempuri.org/:SecureRestBinding")
         {
             // Check to see if there is an Authorization in the header, otherwise throw a 401
             if (WebOperationContext.Current.IncomingRequest.Headers["Authorization"] == null)
             {
                 WebOperationContext.Current.OutgoingResponse.Format = WebMessageFormat.Json;
                 WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate: Basic realm=\"myrealm\"");
                 throw new WebFaultException<string>("No username or password was provided", HttpStatusCode.Unauthorized);
             }
             else 
             {
                 //Code to validate oauth token?
             }
         }

这确保只检查REST消息，SOAP消息通过安全令牌处理程序处理。我需要填写代码来验证oauth令牌，但我似乎无法在任何地方找到一个好的例子。

web.config 案例中的相关内容：

    <system.serviceModel>
        <services>
        <service behaviorConfiguration="MyServiceBehavior"                 name="MyWCFWebRole.MyWcfService">

        <endpoint address="/REST/" 
                  behaviorConfiguration="MyRestBehavior"
                  binding="webHttpBinding" bindingConfiguration="RESTSSLBinding"
                  name="RestSSLEndpoint" bindingName="SecureRestBinding" 
                  contract=MyWCFWebRole.MyWcfServic" />

        <endpoint address="/SOAP/" 
                  binding="basicHttpBinding"
                  bindingConfiguration="secureHttpBinding" 
                  name="SecureHttpEndpoint"
                  bindingName="SecureHttpBinding" 
                  contract="MyWCFWebRole.MyWcfServic" />
      </service>
    </services>
    <bindings>
      <webHttpBinding>
        <binding name="RESTSSLBinding">
          <security mode="Transport">
            <transport clientCredentialType="None" />
          </security>
        </binding>
      </webHttpBinding>
      <basicHttpBinding>
        <binding name="secureHttpBinding">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName" />
          </security>
        </binding>
      </basicHttpBinding>
      <ws2007FederationHttpBinding>
        <binding name="">
          <security mode="Message">
            <message>
              <issuerMetadata address="mex_address" />
            </message>
          </security>
        </binding>
      </ws2007FederationHttpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="MyRestBehavior">
          <webHttp helpEnabled="true" faultExceptionEnabled="true" />
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="MyServiceBehavior">
          <serviceMetadata httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceAuthorization principalPermissionMode="Always" />
          <serviceCredentials useIdentityConfiguration="true"/>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment minFreeMemoryPercentageToActivateService="0" aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
    <protocolMapping>
      <add scheme="http" binding="ws2007FederationHttpBinding" />
    </protocolMapping>
  </system.serviceModel>
  <system.webServer>
    <defaultDocument>
      <files>
        <clear />
        <add value="MyService.svc" />
      </files>
    </defaultDocument>
    <modules runAllManagedModulesForAllRequests="true" />
    <!--
        To browse web app root directory during debugging, set the value below to true.
        Set to false before deployment to avoid disclosing web app folder information.
    -->
    <directoryBrowse enabled="false" />
  </system.webServer>

感谢任何帮助。使用.net 4.5

在WCF消息检查器中验证Oauth访问令牌

0 个答案: