Question

我已经在现有的ASPNET Webforms站点内创建了WCF服务，然后我将FormsAuthentication添加到aspnet站点，在location标记中添加了一个部分以允许匿名访问.svc文件，我可以浏览WSDL文件没有问题，但是当我尝试调用该服务时，我得到了302，该服务已设置为使用basicAuth。

我尝试添加一个HttpModule来拦截服务请求并返回一条适当的消息，但是它也不起作用。

这是服务文件夹中的Webconfig。

<?xml version="1.0"?>
<configuration>
  <system.web>
    <httpModules>
      <add name="AuthRedirectHandler" type="Test.Modules.AuthRedirectHandler, Test" />
    </httpModules>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
      <add name="AuthRedirectHandler" type="Test.Modules.AuthRedirectHandler, Test" preCondition="managedHandler"/>
    </modules>
  </system.webServer>
</configuration>

HttpModule，添加了其他一些事件，但没有一个被击中

public class AuthRedirectHandler : IHttpModule
    {
        public void Dispose()
        {
            //throw new NotImplementedException(); -- do nothing here
        }

        public void Init(HttpApplication context)
        {
            context.EndRequest += new EventHandler(context_EndRequest);
            context.BeginRequest += Context_BeginRequest;
            context.AuthenticateRequest += Context_AuthenticateRequest;
            context.AuthorizeRequest += Context_AuthorizeRequest;
            context.PreRequestHandlerExecute += Context_PreRequestHandlerExecute;
            context.PostAuthorizeRequest += Context_PostAuthorizeRequest;
        }

        private void Context_PostAuthorizeRequest(object sender, EventArgs e)
        {
            int k = 0;
        }

        private void Context_PreRequestHandlerExecute(object sender, EventArgs e)
        {
            int k = 0;
        }

        private void Context_AuthorizeRequest(object sender, EventArgs e)
        {
            int k = 0;
        }

        private void Context_AuthenticateRequest(object sender, EventArgs e)
        {
            int k = 0;
        }

        private void Context_BeginRequest(object sender, EventArgs e)
        {
            int k = 0;
        }

        void context_EndRequest(object sender, EventArgs e)
        {
            HttpApplication app = (HttpApplication) sender;

            if (app != null &&
                app.Response.StatusCode == 302)//302 Found
            {
                app.Response.ClearHeaders();
                app.Response.ClearContent();
                app.Response.StatusCode = 401;
            }
        }

当我在提琴手的请求下进行检查时，可以对服务执行常规的HttpWebRequest，但是当我尝试调用方法时，会收到302响应，该响应将继续加载我的登录页面。

Answer 1

这是针对某些可能需要解决此问题的参考的，我最终选择了这条路线

删除.svc文件的任何形式的安全性
创建一个messageInspector来向WCF（Client）添加Basic Auth标头
将messageInspector添加到ServiceBehavior
将serviceBehavior添加到服务端点行为中
在服务中，创建一个ServiceAuthorizationManager
将ServiceAuthorizationManager添加到服务的web.config中

1。删除所有安全性

<location path="Services/UpdaterService.svc">
    <system.web>
      <authorization>
        <allow users="?"/>
      </authorization>
    </system.web>
  </location>

2。创建一个messageInspector以将Basic Auth标头添加到WCF（客户端）

public class ServiceMessageServiceCredentialsInspector : IClientMessageInspector
    {
        public void AfterReceiveReply(ref Message reply, object correlationState)
        {
        }

        public object BeforeSendRequest(ref Message request, IClientChannel channel)
        {

            HttpRequestMessageProperty requestMessageProperty = request.Properties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
            requestMessageProperty.Headers[HttpRequestHeader.Authorization] = "Basic " +
                    Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}"));

            return null;
        }
    }

3。将messageInspector添加到ServiceBehavior

public class ServiceInterceptionBehavior : BehaviorExtensionElement,IEndpointBehavior
    {
        public override System.Type BehaviorType
        {
            get { return typeof(ServiceInterceptionBehavior); }
        }

        public void AddBindingParameters(ServiceEndpoint endpoint, BindingParameterCollection bindingParameters)
        {

        }

        public void ApplyClientBehavior(ServiceEndpoint endpoint, ClientRuntime clientRuntime)
        {
            clientRuntime.MessageInspectors.Add(new ServiceMessageServiceCredentialsInspector());
        }

        public void ApplyDispatchBehavior(ServiceEndpoint endpoint, EndpointDispatcher endpointDispatcher)
        {

        }

        public void Validate(ServiceEndpoint endpoint)
        {
        }

        protected override object CreateBehavior()
        {
            throw new NotImplementedException();
        }
    }

4。将serviceBehavior添加到您的服务端点行为

EndpointAddress address = new 
      EndpointAddress("http://localhost:14138/Services/Service.svc");
                        ChannelFactory<IService> myChannelFactory = new 
      ChannelFactory<IUpdaterService>(defaultBinding, address);
                            myChannelFactory.Endpoint.EndpointBehaviors.Add(new ServiceInterceptionBehavior());
                            var address2 = myChannelFactory.CreateChannel(address);

5。在服务中，创建一个ServiceAuthorizationManager

public class ServiceAuthorizationManager : ServiceAuthorizationManager
    {
        protected override bool CheckAccessCore(OperationContext operationContext)
        {
            //Extract the Athorizationm Header,a nd parse out the credentials converting to base64 string
            var authHeader = WebOperationContext.Current.IncomingRequest.Headers["Authorization"];
            if ((authHeader != null) && (authHeader != string.Empty))
            {
                var svcCredentials = System.Text.ASCIIEncoding.ASCII
                   .GetString(Convert.FromBase64String(authHeader.Substring(6)))
                   .Split(':');
                return DefaultPasswordValidator.ValidateCridentials(svcCredentials[0], svcCredentials[1]);
            }
            else
            {
                //No authorization header was provided, so challenge the client to provide before proceeding:
                WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate: Basic realm=\"UpdaterService\"");
                //Throw an exception with the associated HTTP status code equivalent to HTTP status 401
                throw new FaultException("Please provide a username and password");
            }
        }

6。将ServiceAuthorizationManager添加到服务的web.config中

<serviceAuthorization serviceAuthorizationManagerType="ServiceAuthorizationManager, AssemblyName, Version=2.0.0.1, Culture=neutral, PublicKeyToken=null" />
          <serviceAuthenticationManager serviceAuthenticationManagerType="ServiceAuthenticationManager, AssemblyName"
            authenticationSchemes="Basic" />

抛出302的ASPNET Web表单内的WCF服务

1 个答案: