WCF一步一步往前爬（五）

第五步：

WCF安全机制---续。

传输通道级别保护一个HTTP服务

1、在ProductsServiceHost项目app.config右键“编辑WCF配置”，新建一个绑定配置，类型为basicHttpBinding，名称ProductsServiceBasicHttpBindingConfig，Mode：Transport。

将终结点BasicHttpBinding_IProductsService的BindingConfigration设为ProductsServiceBasicHttpBindingConfig。

        <basicHttpBinding>
          <binding name="ProductsServiceBasicHttpBindingConfig">
            <security mode="Transport" />
          </binding>
        </basicHttpBinding>

......

       <endpoint address="https://192.168.1.101:8000/ProductsService/ProductsService.svc"
            binding="basicHttpBinding" bindingConfiguration="ProductsServiceBasicHttpBindingConfig"
            name="BasicHttpBinding_IProductsService" contract="ProductsServiceLibrary.IProductsService" />

2、在ProductsClient客户端项目app.config类似的设置

        <binding name="ProductsClientBasicHttpBindingConfig">
                    <security mode="Transport" />
         </binding>

......

          <endpoint address="https://192.168.1.101:8000/ProductsService/ProductsService.svc"
                binding="basicHttpBinding" bindingConfiguration="ProductsClientBasicHttpBindingConfig"
                contract="ProductsService.IProductsService" name="BasicHttpBinding_IProductsService" />

接下来比较重要的就是用SSL证书，设置一个WCF HTTP 终结点

1、以管理的身份打开Visual Studio 命令提示（2010），在命令平台输入

makecert -sr LocalMachine -ss My -n CN=HTTPS-Server -sky exchange -sk HTTPS-Key

2、平台输出Succeeded，就可再输入mmc。在控制台，文件->添加或删除管理单元，在可用管理单元选择证书-〉添加-〉计算机账户-〉下一步，完成。然后你可以看到上面生成的证书，如图

 

3、双击HTTPS-Server，详细信息-〉指纹。把其十六进制值复制下来。

 

4、将ssl证书设置到http终结点上

netsh http add sslcert ipport=192.168.1.101:8000 certhash=‎a225882af2048f404a5bf235290f516fea7836f3 appid={00112233-4455-6677-8899-AABBCCDDEEFF}

（注意ipport中ip地址是自己电脑的ip地址，用127.0.0.1也可以。但是服务端和客户端的终结点地址一点也是这个ip地址，不能是localhost）

5、新建类PermissiveCertificatePolicy

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Security.Cryptography.X509Certificates;
using System.Net;

namespace ProductsClient
{
    class PermissiveCertificatePolicy
    {
        string subjectName;
        static PermissiveCertificatePolicy currentPolicy;
        PermissiveCertificatePolicy(string subjectName)
        {
            this.subjectName = subjectName;
            ServicePointManager.ServerCertificateValidationCallback += new System.Net.Security.RemoteCertificateValidationCallback(RemoteCertValidate);
        }
        public static void Enact(string subjectName)
        {
            currentPolicy = new PermissiveCertificatePolicy(subjectName);
        }
        bool RemoteCertValidate(object sender, X509Certificate cert,X509Chain chain, System.Net.Security.SslPolicyErrors error)
        {
            if (cert.Subject == subjectName)
            {
                return true;
            }
            return false;
        }
    }
}

6、客户端

   static void Main(string[] args)
        {
            Console.WriteLine("Press ENTER when the service has started");
            Console.ReadLine();
            // Create a proxy object and connect to the service
            PermissiveCertificatePolicy.Enact("CN=HTTPS-Server");

......

}

 

消息级别保护一个HTTP服务（使用WS2007HttpBinding）

 

1、添加一个WS2007HttpBinding_IProductsService终结点

     <endpoint address="http://localhost:8010/ProductsService/Service.svc"
           binding="ws2007HttpBinding"
           name="WS2007HttpBinding_IProductsService" contract="ProductsServiceLibrary.IProductsService" />

2、Visual Studio 命令提示（2010），在命令平台输入netsh http add urlacl url=http://localhost:8010/ProductsService user=UserName

3、客户端配置终结点

<endpoint address="http://localhost:8010/ProductsService/Service.svc"
           binding="ws2007HttpBinding"
           name="WS2007HttpBinding_IProductsService" contract="ProductsServiceLibrary.IProductsService" />

4、客户端

static void Main(string[] args)
{
...
 using (ProductsServiceClient proxy = new ProductsServiceClient("WS2007HttpBinding_IProductsService"))

// Test the operations in the service
...
}

 

在windows域内授权windows用户（使用basicHttpBinding）

1、该实例基于前面“传输通道级别保护一个HTTP服务”的代码基础上，修改ProductsServiceLibrary项目.引入PresentationFramework, PresentationCore,System.Xaml, 和WindowsBase组件。

    public class ProductsServiceImpl : IProductsService
    {
        static IList<tblProduct> ps = Builder<tblProduct>.CreateListOfSize(50).Build();
        static IList<tblProductInventory> pis = Builder<tblProductInventory>.CreateListOfSize(50).Build();

        public List<string> ListProducts()
        {
            string userName = Thread.CurrentPrincipal.Identity.Name;
            MessageBox.Show(string.Format("Username is {0}", userName),"ProductsService Authentication", MessageBoxButton.OK);

.......

     }

 2、项目ProductsServiceHost的配置文件ProductsServiceBasicHttpBindingConfig的TransportClientCredentialType设置为basic（或windows），项目ProductsClient的配置文件ProductsClientBasicHttpBindingConfig的TransportClientCredentialType设置为basic（或windows）。

       static void Main(string[] args)
        {

          

           Console.WriteLine("Press ENTER when the service has started");
            Console.ReadLine();
            // Create a proxy object and connect to the service
            PermissiveCertificatePolicy.Enact("CN=HTTPS-Server");

            using (ProductsServiceClient proxy = new ProductsServiceClient("BasicHttpBinding_IProductsService"))
            {
                try
                {
                    proxy.ClientCredentials.UserName.UserName = "workgroup\\ls";
                    proxy.ClientCredentials.UserName.Password = "911";

              ........

        }

UserName和Password 根据自己的电脑为准。

运行结果：