Question

我尝试实现一个托管在IIS上的WCF服务，用户要求进行一些模板文件转换，然后返回处理过的文件（如果他们被授权使用他们要求的模板）。
我选择了visual studio项目模板“WCF Service Application”，并获得了一个aspNetCompatibilityEnabled设置为true的项目。我想用AzMan授权实现我的需要，因为我熟悉那个机制，并且用它做了类似的事情但是，由于我获得401未经授权，我无法调试服务。我假设没有发送用户令牌。

1。如何为WCF，IIS托管服务启用Azman使用？
2. WCF中是否嵌入了类似的机制，可以帮助检查用户是否属于允许访问某个站点文件夹的组？

Confiuration：

<configuration>
   <connectionStrings>
      <add name="LocalPolicyStore"connectionString="msxml://c:/RolesData/azmanstore.xml" />             </connectionStrings>
   <appSettings>
      <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  </appSettings>
<system.web>
   <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5"/>
    <authentication mode="Windows" />
    <authorization>
       <deny users="?" />
     </authorization>
     <roleManager enabled="true" cacheRolesInCookie="true" defaultProvider="RoleManagerAzManProvider" cookieName=".ASPXROLES" cookiePath="/" cookieTimeout="30" cookieRequireSSL="true" cookieSlidingExpiration="true" createPersistentCookie="false" cookieProtection="All">
   <providers>
    <add name="RoleManagerAzManProvider" type="System.Web.Security.AuthorizationStoreRoleProvider, System.Web, Version=4.0.0.0, Culture=neutral, publicKeyToken=b03f5f7f11d50a3a" connectionStringName="LocalPolicyStore" applicationName="DRP" />
  </providers>
 </roleManager>
</system.web>
<system.serviceModel>
<behaviors>
  <serviceBehaviors>
    <behavior name="metadataBehavior">
      <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"  />
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug includeExceptionDetailInFaults="false"/>

      <serviceAuthorization principalPermissionMode="UseAspNetRoles" 
                      roleProviderName="RoleManagerAzManProvider" />
    </behavior>
  </serviceBehaviors>
</behaviors>
<services>
  <service name="ExcelGeneratingService.ExcelGeneratorService" behaviorConfiguration="metadataBehavior">
    <endpoint
      address=""  
      binding="basicHttpBinding" bindingConfiguration="excelGeneratorServiceBinding"
      contract="ExcelGeneratingService.IExcelGeneratorService"/>
    <endpoint
        address="mex"
        binding="mexHttpBinding"
        contract="IMetadataExchange"/>
  </service>
</services>
 <bindings>
  <basicHttpBinding>
      <binding name="excelGeneratorServiceBinding">
          <security mode="TransportCredentialOnly">
              <transport clientCredentialType="Windows" />
          </security>
      </binding>
  </basicHttpBinding>
 </bindings>
<protocolMapping>
    <add binding="basicHttpsBinding" scheme="https" />
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true"   multipleSiteBindingsEnabled="true" />
 </system.serviceModel>
 <system.webServer>
 <modules runAllManagedModulesForAllRequests="true"/>
  <!--
      To browse web app root directory during debugging, set the value below to true.
    Set to false before deployment to avoid disclosing web app folder information.
  -->
<directoryBrowse enabled="true"/>
</system.webServer>

 </configuration>

代码：

     //Check if the user is allowed to access this path
     if (!UrlAuthorizationModule.CheckUrlAccessForPrincipal(virtPath, user, "GET"))
        {
            return false;
        }

Answer 1

我已经解决了。我希望它能帮助别人。

对配置进行了一些修复（附加）。允许所有用户，但在较低级别的文件夹中进行过滤。
在操作系统上的IIS上安装缺少的授权处理程序（打开Windows功能...）
使用本地IIS而不是Visual Studio中的IIS Express
如果IIS visrtual文件夹创建失败，请清除用户数据文件夹（C：\ Users \\ Documents \ IISExpress \ config）中的IIS Express配置
为我的azman商店提供服务应用程序池用户（来自IIS）的读者安全权限（在azman控制台上）。

配置：

   <?xml version="1.0" encoding="UTF-8"?>
   <configuration>
      <connectionStrings>
         <add name="LocalPolicyStore" connectionString="msxml://c:/RolesData/ExcelGeneration.xml" />
          </connectionStrings>
          <appSettings>
             <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
          </appSettings>
       <system.web>
       <compilation debug="true" targetFramework="4.5" />
       <httpRuntime targetFramework="4.5" />
       <authentication mode="Windows" />
       <authorization>
          <allow users="*" />
       </authorization>
       <identity impersonate="false" />
       <roleManager enabled="true" cacheRolesInCookie="true" defaultProvider="RoleManagerAzManProvider" cookieName=".ASPXROLES" cookiePath="/" cookieTimeout="30" cookieRequireSSL="true" cookieSlidingExpiration="true" createPersistentCookie="false" cookieProtection="All">
         <providers>
           <add name="RoleManagerAzManProvider" type="System.Web.Security.AuthorizationStoreRoleProvider, System.Web, Version=4.0.0.0, Culture=neutral, publicKeyToken=b03f5f7f11d50a3a" connectionStringName="LocalPolicyStore" applicationName="ExcelGeneration" />
         </providers>
      </roleManager>
    </system.web>
 <system.serviceModel>
    <behaviors>
       <serviceBehaviors>
           <behavior name="metadataBehavior">
               <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
               <serviceDebug includeExceptionDetailInFaults="true" />
               <serviceAuthorization principalPermissionMode="UseAspNetRoles"
        roleProviderName="RoleManagerAzManProvider" />
          </behavior>
  </serviceBehaviors>
</behaviors>
<services>
  <service name="ExcelGeneratingService.ExcelGeneratorService" behaviorConfiguration="metadataBehavior">
    <endpoint address="" bindingConfiguration="excelGeneratorServiceBinding" binding="basicHttpBinding" contract="ExcelGeneratingService.IExcelGeneratorService">
      <identity>
        <dns value="localhost" />
      </identity>
    </endpoint>
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>
<bindings>
  <basicHttpBinding>
      <binding name="excelGeneratorServiceBinding">
          <security mode="TransportCredentialOnly">
              <transport clientCredentialType="Windows" />
          </security>
      </binding>
  </basicHttpBinding>
</bindings>

   <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
   <serviceHostingEnvironment aspNetCompatibilityEnabled="true"  multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
  <system.webServer>
      <modules runAllManagedModulesForAllRequests="true" />
      <!--
          To browse web app root directory during debugging, set the value  below to true.
    Set to false before deployment to avoid disclosing web app folder information.
       -->
     <directoryBrowse enabled="true" />
   </system.webServer>

使用AzMan角色提供程序实现IIS托管的WCF服务

1 个答案: