Question

我一直在努力让自定义UserNamePasswordValidator与我的netHttpsBinding一起使用.Net 4.5 WCF网络服务。我的问题是验证程序永远不会被调用或强制执行，因此任何凭据（或没有凭据）都可以访问。

我很确定配置是正确的，因为我可以为wsHttpBinding使用几乎相同的配置，它可以工作。这是web.config ...

<services>
  <service name="MyNamespace.MyService" behaviorConfiguration="serviceBehavior">
    <endpoint address="" binding="wsHttpBinding" contract="MyNamespace.IMyService" />
    <!-- This one doesn't authenticate 
    <endpoint address="" binding="netHttpsBinding" contract="MyNamespace.IMyService" />
    -->
    <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
  </service>
</services>
<bindings>
  <wsHttpBinding>
    <binding>
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </wsHttpBinding>
  <netHttpsBinding>
    <binding>
      <security mode="TransportWithMessageCredential">
        <message clientCredentialType="UserName" />
      </security>
    </binding>
  </netHttpsBinding>
</bindings>
<behaviors>
  <serviceBehaviors>
    <behavior name="serviceBehavior">
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyNamespace.MyValidator, MyAssembly"/>
      </serviceCredentials>
      <serviceMetadata httpsGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>
</behaviors>

如果重要的话，这是验证者......

using System.IdentityModel.Selectors;
using System.ServiceModel;
namespace MyNamespace
{
    public class MyValidator : UserNamePasswordValidator
    {
        public override void Validate(string userName, string password)
        {
            if (null == userName || null == password)
                throw new FaultException("Username or Password were not set.");
            if (!(userName == "MyUser" && password == "MyPassword"))
                throw new FaultException("Unknown Username or Incorrect Password");
        }
    }
}

有谁知道为什么UserNamePasswordValidator不能与netHttpsBinding一起使用？或者我做错了什么？

Answer 1

尝试使用NetHttpBinding而不是NetHttpsBinding。如果保留TransportWithMessageCredential，您仍将获得所有正确的安全模式设置。我试过这个并且它有效。但是，是的，如果我使用NetHttpsBinding，我可以重现这种行为。

Answer 2

这并没有直接回答这个问题，但我最终放弃了netHttpsBinding以获得带二进制编码的自定义绑定。据我所知，它完成了同样的事情。我的配置的简化示例...

<services>
  <service name="MyNamespace.MyService" behaviorConfiguration="serviceBehavior">
    <endpoint address="" binding="customBinding" bindingConfiguration="CustomBinding" contract="MyNamespace.IMyService" />
    <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
  </service>
</services>
<bindings>
  <customBinding>
    <binding name="CustomBinding">
      <security authenticationMode="UserNameOverTransport"></security>
      <binaryMessageEncoding />
      <httpsTransport />
    </binding>
  </customBinding>
</bindings>
<behaviors>
  <serviceBehaviors>
    <behavior name="serviceBehavior">
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyNamespace.MyValidator, MyAssembly"/>
      </serviceCredentials>
      <serviceMetadata httpsGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>
</behaviors>

netHttpsBinding与自定义UserNamePasswordValidator

2 个答案: