Question

最近，我一直致力于通过在IIS7上托管的DotNetOpenAuth网络服务受OAuth保护的WCF SOAP Web服务。我很高兴地说我已经让项目工作了 - 也就是说，它适用于http。

下一步是将两个项目（消费者和服务提供商，后者包含Web服务）移至https。然而，这会造成一些麻烦。

当从消费者调用DataApi.svc时，我收到以下错误;

Server Error in '/consumerexample/v2' Application.
--------------------------------------------------------------------------------

The username is not provided. Specify username in ClientCredentials. 
Description: An unhandled exception occurred during the execution of the current web request.     Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.InvalidOperationException: The username is not provided. Specify username in ClientCredentials.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  

Stack Trace: 


[InvalidOperationException: The username is not provided. Specify username in ClientCredentials.]
System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg) +4727747
System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type) +1725
OAuthConsumer.SampleServiceProvider.IDataApi.retrieveTimeTable(String weekVan, String weekTot) +0
OAuthConsumer.SampleServiceProvider.DataApiClient.retrieveTimeTable(String weekVan, String weekTot) in C:\Program Files\TimeTableWebService\consumer\OAuthConsumer\Service References\SampleServiceProvider\Reference.cs:108
OAuthConsumer.<>c__DisplayClass6.<retrieveTimeTable_Click>b__5(DataApiClient client) in C:\Program Files\TimeTableWebService\consumer\OAuthConsumer\GetTimeTable.aspx.cs:76
OAuthConsumer.GetTimeTable.CallService(Func`2 predicate) in C:\Program Files\TimeTableWebService\consumer\OAuthConsumer\GetTimeTable.aspx.cs:129
OAuthConsumer.GetTimeTable.retrieveTimeTable_Click(Object sender, EventArgs e) in C:\Program Files\TimeTableWebService\consumer\OAuthConsumer\GetTimeTable.aspx.cs:76
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +154
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3707

--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.237

在http上，这就像魅力一样。当我在本地调试消费者时，整个OAuth授权工作得非常好。只有当我的DataApi.svc中的方法retrieveTimeTable被调用时才会收到此错误。

在IIS7上，我为消费者和服务提供者站点启用了匿名和基本身份验证。 web.config文件如下;

消费

<system.serviceModel>
  <bindings>
    <wsHttpBinding>
      <binding name="WSHttpBinding_IDataApi" closeTimeout="00:01:00"
     openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
     bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
     maxBufferPoolSize="524288" maxReceivedMessageSize="999999999" messageEncoding="Text"
     textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">

        <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
       maxBytesPerRead="4096" maxNameTableCharCount="16384" />
        <reliableSession ordered="true" inactivityTimeout="00:10:00"
       enabled="false" />

        <security mode="Transport">  
    <transport clientCredentialType="Basic" proxyCredentialType="None" realm=""/>  
    <message clientCredentialType="Certificate" algorithmSuite="Default" /> 
        </security>          

      </binding>
    </wsHttpBinding>
  </bindings>

  <client>
    <endpoint address="https://websrv.hszuyd.nl/serviceprovider/v2/DataApi.svc" binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IDataApi" contract="SampleServiceProvider.IDataApi" name="WSHttpBinding_IDataApi">
      <identity>
        <dns value="localhost" />
      </identity>
    </endpoint>        
  </client>
</system.serviceModel>

服务提供商

<system.serviceModel>
  <behaviors>
    <endpointBehaviors>
      <behavior name="DataApiBehavior">
        <webHttp />
      </behavior>
      <behavior name="wsHttpEnablingBehaviour">
        <webHttp/>
      </behavior>
    </endpointBehaviors>            

    <serviceBehaviors>  
      <behavior name="DataApiBehavior">
        <serviceMetadata httpsGetEnabled="true" />
        <serviceDebug includeExceptionDetailInFaults="true" />
        <serviceAuthorization serviceAuthorizationManagerType="OAuthServiceProvider.Code.OAuthAuthorizationManager, OAuthServiceProvider" principalPermissionMode="Custom" />
      </behavior>
      <behavior name="wsHttpEnablingBehaviour">
        <serviceMetadata httpsGetEnabled="true"/>
        <serviceDebug includeExceptionDetailInFaults="false"/>
      </behavior>
    </serviceBehaviors>
  </behaviors>
  <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />

  <bindings>
    <wsHttpBinding>   
      <binding name="wsHttpBinding" maxReceivedMessageSize="999999999">
        <security mode="Transport">
          <transport clientCredentialType="Basic" />    
        </security>
      </binding>               
    </wsHttpBinding>
  </bindings>
  <services>
    <service behaviorConfiguration="DataApiBehavior" name="OAuthServiceProvider.DataApi">
      <clear/>
      <endpoint address="" binding="wsHttpBinding" contract="OAuthServiceProvider.Code.IDataApi" name="Oauth" bindingConfiguration="wsHttpBinding" />               
    </service>
  </services>
</system.serviceModel>

思想？

Answer 1

可能您的消费者方使用某个代理来呼叫提供商，但没有指定基本身份验证所需的用户/通行证。

Answer 2

我很抱歉，但我不明白。客户端不应使用基本身份验证。基本身份验证只应用于Authorize.aspx页面。所以我认为问题是webservice本身使用基本身份验证而不是oauth，但我现在不知道如何解决这个问题。如果我删除绑定=“wsHttpBinding”的端点是行不通的。（我是Nico的同事）

将Web服务从http移动到https

2 个答案: