【WCF安全】WCF 自定义授权[用户名+密码+x509证书]

1.x509证书制作(略)

2.直接贴代码

----------------------------------------------------------------------服务端-------------------------------------------------------------------------------------------

WCF服务

 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Runtime.Serialization;
 using System.ServiceModel;
 using System.ServiceModel.Web;
 using System.Text;

 namespace WcfService自定义授权
 {

     public class Service1 : IService1
     {
         public string GetData(int value)
         {
             return string.Format("You entered: {0}", value);
         }

         public int GetNumber(int A, int B)
         {
             return A + B;
         }

         public string GetStr(string str)
         {
             return "GetStr:" + str;
         }
     }

     [ServiceContract]
     public interface IService1
     {
         [OperationContract]
         string GetData(int value);
         [OperationContract]
         int GetNumber(int A, int B);
         [OperationContract]
         string GetStr(string str);
     }
 }

WCF服务

安全验证

 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Web;
 using System.Xml;

 namespace WcfService自定义授权
 {
     /// <summary>
     /// 实现自定义用户名密码校验
     /// </summary>
     public class MyCustomUserNameValidator : System.IdentityModel.Selectors.UserNamePasswordValidator
     {
         public override void Validate(string userName, string password)
         {
             if (userName == null || password == null)
             {
                 throw new ArgumentNullException("用户名或密码不能为空");
             }
             if (!HelpCheckUserNamePassWord(userName, password))//(userName != "admin" && userName != "admin2")
             {
                 throw new ArgumentNullException("用户名或密码不正确");
             }
         }

         #region 私有方法
         /// <summary>
         /// 校验用户名密码
         /// </summary>
         /// <param name="userName">用户名</param>
         /// <param name="passWord">密码</param>
         /// <returns></returns>
         private bool HelpCheckUserNamePassWord(string userName, string passWord)
         {
             List<string> list = new List<string>();
             XmlDocument doc = new XmlDocument();
             doc.Load(AppDomain.CurrentDomain.BaseDirectory + "SafetyVerification\\UserRoleConfig.xml");
             XmlNodeList nodes = doc.SelectNodes("UserRoleConfig/User");
             foreach (XmlNode node in nodes)
             {
                 string name = String.Empty;//用户名
                 string pwd = String.Empty;//密码
                 foreach (XmlAttribute xa in node.Attributes)//校验用户名密码
                 {
                     if (xa.Name == "Name" && xa.Value == userName)
                         name = xa.Value;
                     else if (xa.Name == "PassWord" && xa.Value == passWord)
                         pwd = xa.Value;
                     if (!String.IsNullOrEmpty(name) && !String.IsNullOrEmpty(pwd))
                         return true;
                 }
             }
             return false;
         }
         #endregion
     }
 }

校验用户名和密码

 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Web;
 using System.ServiceModel;

 namespace WcfService自定义授权
 {
     /// <summary>
     /// 提供对服务操作的授权访问检查
     /// </summary>
     public class CustomServiceAuthorizationManager : System.ServiceModel.ServiceAuthorizationManager
     {
         protected override bool CheckAccessCore(OperationContext operationContext)
         {
             //请求调用的资源url
             string action = operationContext.RequestContext.RequestMessage.Headers.Action;
             Console.ForegroundColor = ConsoleColor.Red;
             Console.ForegroundColor = ConsoleColor.White;
             //ClaimSet 表示与某个实体关联的声明的集合。
             //获取与授权策略关联的声明集
             foreach (System.IdentityModel.Claims.ClaimSet cs in operationContext.ServiceSecurityContext.AuthorizationContext.ClaimSets)
             {
                 if (cs.Issuer == System.IdentityModel.Claims.ClaimSet.System)
                 {
                     foreach (System.IdentityModel.Claims.Claim claim in cs.FindClaims("http://tempuri.org/", System.IdentityModel.Claims.Rights.PossessProperty))
                     {
                         //校验是否有调用权限
                         if (claim.Resource.ToString() == action)
                         {
                             return true;//通过
                         }
                         else
                         {
                             string url = action.Substring(, action.LastIndexOf('/'));
                             if (claim.Resource.ToString() == url + "/all")//可以调用该服务下所有的方法
                                 return true;
                         }

                     }
                 }
             }
             return false;//不通过
         }
     }
 }

提供对服务操作的授权访问检查

 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Web;
 using System.Xml;

 namespace WcfService自定义授权
 {
     /// <summary>
     /// 查询用户可调用的资源
     /// 定义一组用于对用户进行授权的规则
     /// </summary>
     public class CustomAuthorizationPolicy : System.IdentityModel.Policy.IAuthorizationPolicy
     {
         string id = string.Empty;
         public CustomAuthorizationPolicy()
         {
             id = new Guid().ToString();
         }
         public System.IdentityModel.Claims.ClaimSet Issuer
         {
             get { return System.IdentityModel.Claims.ClaimSet.System; }
         }
         public string Id
         {
             get { return id; }
         }
         /// <summary>
         /// 查询用户可调用的资源
         /// </summary>
         /// <param name="evaluationContext"></param>
         /// <param name="state"></param>
         /// <returns></returns>
         public bool Evaluate(System.IdentityModel.Policy.EvaluationContext evaluationContext, ref object state)
         {
             bool flag = false;
             bool r_state = false;
             if (state == null) { state = r_state; } else { r_state = Convert.ToBoolean(state); }
             if (!r_state)
             {
                 List<System.IdentityModel.Claims.Claim> claims = new List<System.IdentityModel.Claims.Claim>();
                 foreach (System.IdentityModel.Claims.ClaimSet cs in evaluationContext.ClaimSets)
                 {
                     foreach (System.IdentityModel.Claims.Claim claim in cs.FindClaims
                         (System.IdentityModel.Claims.ClaimTypes.Name, System.IdentityModel.Claims.Rights.PossessProperty))
                     {
                         foreach (string str in HelpGetServiceResourceByUserName(claim.Resource.ToString()))
                         {
                             //授权的资源
                             claims.Add(new System.IdentityModel.Claims.Claim("http://tempuri.org/", str, System.IdentityModel.Claims.Rights.PossessProperty));
                         }
                     }
                 }
                 evaluationContext.AddClaimSet(this, new System.IdentityModel.Claims.DefaultClaimSet(Issuer, claims)); r_state = true; flag = true;
             }
             else { flag = true; }
             return flag;
         }

         #region 私有方法
         /// <summary>
         /// 通过用户名密码获取资源列表
         /// </summary>
         /// <param name="userName">用户名</param>
         /// <returns></returns>
         private List<string> HelpGetRoleListBy(string userName)
         {
             List<string> list = new List<string>();
             XmlDocument doc = new XmlDocument();
             doc.Load(AppDomain.CurrentDomain.BaseDirectory + "SafetyVerification\\UserRoleConfig.xml");
             XmlNodeList nodes = doc.SelectNodes("UserRoleConfig/User");
             foreach (XmlNode node in nodes)
             {
                 string name = String.Empty;//用户名
                 foreach (XmlAttribute xa in node.Attributes)//校验用户名密码
                 {
                     if (xa.Name == "Name" && xa.Value == userName)
                     {
                         foreach (XmlNode xn in node.ChildNodes)//查询该用户拥有的角色
                         {
                             if (xn.Name != "Role")
                                 continue;
                             list.Add(xn.InnerXml);
                         }
                         break;
                     }
                 }
             }
             return list;
         }
         /// <summary>
         /// 通过用户名获取资源
         /// </summary>
         /// <param name="userName">用户名</param>
         /// <returns></returns>
         private IEnumerable<string> HelpGetServiceResourceByUserName(string userName)
         {
             List<string> lists = new List<string>();
             List<string> rlist = HelpGetRoleListBy(userName);
             XmlDocument doc = new XmlDocument();
             doc.Load(AppDomain.CurrentDomain.BaseDirectory + "SafetyVerification\\RoleResourceConfig.xml");
             XmlNodeList nodes = doc.SelectNodes("ResourceConfig/Role");
             foreach (XmlNode node in nodes)
             {
                 foreach (XmlAttribute xa in node.Attributes)
                 {
                     if (xa.Name == "Name" && rlist.Contains(xa.Value)) //查询角色下的所有资源
                     {
                         foreach (XmlNode xn in node.ChildNodes)
                         {
                             if (xn.Name == "Resource")
                                 lists.Add(xn.InnerXml);
                         }
                         break;
                     }
                 }
             }
             return lists;
         }
         #endregion

     }

 }

定义一组用于对用户进行授权的规则

Xml配置文件

 <?xml version="1.0" encoding="utf-8" ?>
 <UserRoleConfig>
   <User Name="ptadmin" PassWord="pt8008" >
     <Role>Dictionary</Role>
     <Role>PlatForm</Role>
   </User>
   <User Name="webadmin" PassWord="web8010" >
     <Role>Dictionary</Role>
     <Role>WebSite</Role>
   </User>
   <User Name="eadmin" PassWord="e8011" >
     <Role>EnterpriseLibrary</Role>
   </User>
 </UserRoleConfig>

配置用户和角色

 <?xml version="1.0" encoding="utf-8" ?>
 <ResourceConfig>

   <Role Name="Dictionary">
     <!--格式：地址+方法名；all表示有权限访问该地址下所有的服务方法-->
     <Resource>http://tempuri.org/IService1/all</Resource>
   </Role>

   <Role Name="PlatForm">
     <Resource>http://tempuri.org/IService1/all</Resource>
     <Resource>http://tempuri.org/IService1/all2</Resource>
     <Resource>http://tempuri.org/IService1/all3</Resource>
   </Role>

   <Role Name="WebSite">
     <Resource>http://tempuri.org/IService1/all</Resource>
   </Role>

   <Role Name="EnterpriseLibrary">
     <Resource>http://tempuri.org/IService1/all</Resource>
   </Role>
 </ResourceConfig>

配置角色和资源

web.Config配置文件

 <?xml version="1.0" encoding="utf-8"?>
 <configuration>
   <system.web>
     <compilation debug="true" targetFramework="4.0" />
   </system.web>
   <system.serviceModel>
     <services>
       <service name="WcfService自定义授权.Service1" behaviorConfiguration="httpBehavior">
         <endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsBinding"
                   contract="WcfService自定义授权.IService1">
           <identity>
             <dns value="JRNet01-PC" />
           </identity>
         </endpoint>
         <host>
           <baseAddresses>
             <add baseAddress="http://JRNet01-PC:7794"/>
           </baseAddresses>
         </host>
       </service>
     </services>
     <bindings>
       <wsHttpBinding>
         <binding name="wsBinding">
           <security mode="Message">
             <message clientCredentialType="UserName"/>
           </security>
         </binding>
       </wsHttpBinding>
     </bindings>
     <behaviors>
       <serviceBehaviors>
         <behavior name="httpBehavior">
           <serviceMetadata httpGetEnabled="true"/>
           <serviceCredentials>
             <serviceCertificate findValue="JRNet01-PC" x509FindType="FindBySubjectName" storeLocation="LocalMachine"
                                 storeName="My" />
             <userNameAuthentication userNamePasswordValidationMode="Custom"
                                     customUserNamePasswordValidatorType="WcfService自定义授权.MyCustomUserNameValidator,WcfService自定义授权"/>
             <clientCertificate>
               <!--自定义对客户端进行证书认证方式 这里为 None-->
               <authentication certificateValidationMode="Custom"/>
             </clientCertificate>
           </serviceCredentials>
           <serviceAuthorization serviceAuthorizationManagerType="WcfService自定义授权.CustomServiceAuthorizationManager,WcfService自定义授权">
             <authorizationPolicies>
               <add policyType="WcfService自定义授权.CustomAuthorizationPolicy,WcfService自定义授权"/>
             </authorizationPolicies>
           </serviceAuthorization>
         </behavior>
       </serviceBehaviors>
     </behaviors>
   </system.serviceModel>
   <system.webServer>
     <modules runAllManagedModulesForAllRequests="true"/>
   </system.webServer>
 </configuration>

Web.Config

----------------------------------------------------------------------客户端-------------------------------------------------------------------------------------------

 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;

 namespace WCF自定义授权TestClient
 {
     class Program
     {
         static void Main(string[] args)
         {
             try
             {
                 ServiceReference1.Service1Client sc = new ServiceReference1.Service1Client();
                 sc.ClientCredentials.UserName.UserName = "admin";
                 sc.ClientCredentials.UserName.Password = "";
                 string result = sc.GetStr("asdfg");
                 Console.WriteLine(result);
             }
             catch (Exception ex)
             {
                 Console.WriteLine(ex.Message);
             }
             Console.ReadLine();
         }
     }
 }

Program-Main

 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
   <system.serviceModel>
     <bindings>
       <wsHttpBinding>
         <binding name="WSHttpBinding_IService1">
           <security>
             <message clientCredentialType="UserName" />
           </security>
         </binding>
       </wsHttpBinding>
     </bindings>
     <behaviors>
       <endpointBehaviors>
         <behavior name="myClientBehavior">
           <clientCredentials>
             <!--客户端证书-->
             <clientCertificate findValue="JRNet01-PC" storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName"/>
             <serviceCertificate>
               <authentication certificateValidationMode="None"/>
             </serviceCertificate>
           </clientCredentials>
         </behavior>
       </endpointBehaviors>
     </behaviors>
     <client>
       <endpoint address="http://netnetnet-pc:5003/Service1.svc" binding="wsHttpBinding"
           bindingConfiguration="WSHttpBinding_IService1" contract="ServiceReference1.IService1"
           name="WSHttpBinding_IService1"  behaviorConfiguration="myClientBehavior">
         <identity>
           <dns value="JRNet01-PC" />
         </identity>
       </endpoint>
     </client>
   </system.serviceModel>
 </configuration>

配置文件

源码下载：WcfService自定义授权.rar