基本身份验证和WCF REST服务配置问题

时间:2016-07-10 16:03:08

标签: c# rest wcf iis-7.5 basic-authentication

我一直试图解决这个问题几天。我知道我很接近但不能完全弄清楚我错过了什么。

  • 该服务位于IIS上托管的网站
  • 为站点启用了基本身份验证,并禁用了包括匿名身份验证在内的所有其他身份验证。
  • 我创建了自签名证书并设置了https绑定
  • 我已经覆盖了UsernamePasswordValidator的Validate方法,但是当我附加一个断点时,它没有到达。所以我的问题可能与此有关。
  • 当我尝试在https://localhost/Services/JobSiteService.svc/rest/get访问我的服务方法时,由于收到401未经授权的错误,我不断被提示输入用户名和密码。

谁能看到我做错了什么?

以下适当的代码:

的Web.Config

  <system.serviceModel>
<bindings>
  <webHttpBinding>
    <binding name="webHttpTransportSecurity">
      <security mode="Transport">
        <transport clientCredentialType="Basic"  />
      </security>
    </binding>
  </webHttpBinding>
</bindings>

<services>
  <service name="Validity.WebService.JobSiteService" behaviorConfiguration="SecureRestBehavior">
    <endpoint address="rest"  binding="webHttpBinding" behaviorConfiguration="RESTBehavior" bindingConfiguration="webHttpTransportSecurity" contract="Validity.WebService.Contracts.IJobSiteService"  />
    <endpoint address="meta" binding="mexHttpsBinding" contract="IMetadataExchange" />
  </service>
</services>

<behaviors>
  <serviceBehaviors>
    <behavior name="SecureRestBehavior">
      <serviceMetadata httpGetEnabled="false" httpsGetEnabled="true"/>
      <serviceDebug includeExceptionDetailInFaults="false"/>

      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom"  customUserNamePasswordValidatorType="Validity.WebService.IdentityValidator, Validity.WebService" />
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>

  <endpointBehaviors>
    <behavior name="RESTBehavior" >
      <webHttp/>
    </behavior>
  </endpointBehaviors>
</behaviors>

<protocolMapping>
  <add binding="webHttpBinding" scheme="https" />
</protocolMapping>

<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />

服务合同:

    [ServiceContract]
public interface IJobSiteService
{
    [OperationContract]
    [WebInvoke(Method="GET", ResponseFormat=WebMessageFormat.Json)]
    List<JobSite> Get();
}

自定义验证器(它位于命名空间“Validity.WebService”中,但是当我包含它时代码格式化了。):

        public override void Validate(string userName, string password)
    {
        using (var context = new ValidityContext())
        {

            using (var userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(context)))
            {
                var user = userManager.Find(userName, password);
                if (user == null)
                {
                    var msg = String.Format("Unknown Username {0} or incorrect password {1}", userName, password);
                    throw new FaultException(msg);//the client actually will receive MessageSecurityException. But if I throw MessageSecurityException, the runtime will give FaultException to client without clear message.
                }
                else
                {

                    SessionOperationContext.Current.Items["CurrentUser"] = user;
                }
            }
        }
    }

对此的任何帮助将不胜感激。

1 个答案:

答案 0 :(得分:0)

终于想通了。

解决方案是禁用IIS服务器上的基本身份验证,并覆盖ServiceAuthorizationManager的CheckAccessCore方法以验证用户。