WebService的两种用户验证方式

1,使用SoapHeader传递和验证用户
 Web Service端的代码:
 1.1先创建一个继承自System.Web.Services.Protocols.SoapHeader
    CredentialSoapHeader类:
   public class CredentialSoapHeader : SoapHeader
   {
 private string _userName ;
 private string _userPassword ;

 public string UserName
 {
  get { return _userName ; }
  set { _userName = value ; }
 }

 public string UserPassword
 {
  get { return _userPassword ; }
  set { _userPassword = value ; }
 }
   }

  1.2创建对外发布的Web Service方法
  public class MyService :  System.Web.Services.WebService
  {
 private CredentialSoapHeader m_credentials ;
 public CredentialSoapHeader Credentails
 {
  get { return m_credentials ; }
  set { m_credentials = value ; }
 }
       
        //对外发布的服务
        [WebMethod(BufferResponse = true,Description = "欢迎方法" ,CacheDuration = 0,EnableSession=false,
   MessageName = "HelloFriend",TransactionOption = TransactionOption.Required)]
 [SoapHeader("Credentails")]
 public string Welcome(string userName)
 {
  this.VerifyCredential(this) ;
  return "Welcome " + userName ;
 }

        //验证是否合法
        private void VerifyCredential(MyService s)
 {
  if ( s.Credentails == null || s.Credentails.UserName == null || s.Credentails.UserPassword == null )
  {
   throw new SoapException("验证失败",SoapException.ClientFaultCode,"Security") ;
  }
                //在这里可以进一步进行自定义的用户验证
 }
  }

  创建使用MyService的客户端(本处使用WinForm来做实例)
  先把MyService的引用添加进来
  public class ClientForm : System.Windows.Forms.Form
  {
 public ClientForm()
 {
  MyService s = new MyService() ;
  this.InitWebServiceProxy(s) ;
  string temp = s.Welcome("test") ;
  
  MessageBox.Show(temp) ;
 }

 private void InitWebServiceProxy(MyService s)
 {
  CredentialSoapHeader soapHeader = new CredentialSoapHeader() ;
  soapHeader.UserName = "test" ;
  soapHeader.UserPassword = "test" ;
  s.CredentialSoapHeaderValue = soapHeader ;

  string urlSettings = null ; //这里可以从配置文件中获取

  if (urlSettings != null )
  {
   s.Url = urlSettings ;
  }

  s.Credentials = (System.Net.NetworkCredential)CredentialCache.DefaultCredentials  ;
 }
  }
 
 
2,使用验证票(AuthorizationTicket)
using System.Web.Security ;
[WebMethod()]
public string GetAuthorizationTicket(string userName , string password)
{
     //这里可以做一些自定义的验证动作，比如在数据库里验证用户的合法性等
     FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(userName, false, timeOut) ;
     string encryptedTicket = FormsAuthentication.Encrypt(ticket) ;
     Context.Cache.Insert(encryptedTicket, userName, null, DateTime.Now.AddMinutes(timeout), TimeSpan.Zero) ;
     return encryptedTicket ;
}

private bool IsTicketValid(string ticket, bool IsAdminCall)
{
    if (ticket == null || Context.Cache[ticket] == null)
    {
  // not authenticated
  return false;
    }
    else
    {
         //这里再做一些验证，比如在数据库里验证用户的合法性等
    }
}

[WebMethod()]
public Book GetBookByBookId(int bookId)
{
    if (IsTicketValid)
    {
        //验证通过才可以执行特定操作了
    }
}