如何在WCF解决方案中使用WCS（windows cardspace）作为身份验证方式
本文提供了一个引导步骤，讲解了如何在WCF解决方案中采用WCS作为身份验证方式。本文假设你已经清楚地了解了WCF的各项机制。
第一部分：服务部分
1. 服务契约
using System.ServiceModel; namespace HelloService { [ServiceContract] public interface IHello { [OperationContract] string Say(); } }
2. 服务实现和宿主程序
需要预先引用System.ServiceModel，System.IdentityModel
using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.ServiceModel; using System.IdentityModel.Claims; using System.IdentityModel.Policy; namespace HelloService { class Hello : IHello { #region IHello 成员 public string Say() { GetIdentity(); return "Hello,World"; } private void GetIdentity() { AuthorizationContext ctx = OperationContext.Current.ServiceSecurityContext.AuthorizationContext; foreach (ClaimSet claimSet in ctx.ClaimSets) { foreach (Claim claim in claimSet) { Console.WriteLine(); Console.WriteLine("ClaimType: " + claim.ClaimType); Console.WriteLine("Resource: " + claim.Resource); Console.WriteLine("Right: " + claim.Right); } } return; } #endregion } class Program { static void Main(string[] args) { ServiceHost sh = new ServiceHost(typeof(Hello), new Uri("http://localhost:4123/helloService")); sh.Open(); Console.WriteLine("Service listening..."); Console.WriteLine("Press <Enter> to finish"); Console.ReadLine(); sh.Close(); // close the service } } }
代码中的GetIdentity方法是我们自己写的，主要是为了解析Windows Cardspace传递过来的凭据信息。
3. 服务配置
<?xml version="1.0" encoding="utf-8" ?> <configuration> <system.serviceModel> <services> <service name="HelloService.Hello" behaviorConfiguration="helloServiceBehavior"> <endpoint address="helloEndpoint" contract="HelloService.IHello" binding="wsFederationHttpBinding" bindingConfiguration="helloFederatedBinding"> <identity> <certificateReference findValue="WCFTestCert" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /> </identity> </endpoint> <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" /> </service> </services> <bindings> <wsHttpBinding> <binding name="helloBinding"> <security mode="Message"> <message clientCredentialType="IssuedToken" /> </security> </binding> </wsHttpBinding> <wsFederationHttpBinding> <binding name="helloFederatedBinding" > <security mode="Message"> <message algorithmSuite="Basic128" issuedTokenType="urn:oasis:names:tc:SAML:1.0:assertion" issuedKeyType="SymmetricKey"> <issuer address="http://schemas.xmlsoap.org/ws/2005/05/identity/issuer/self"/> <claimTypeRequirements> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/> </claimTypeRequirements> </message> </security> </binding> </wsFederationHttpBinding> </bindings> <behaviors> <serviceBehaviors> <behavior name="helloServiceBehavior"> <serviceMetadata httpGetEnabled="true" /> <serviceCredentials> <issuedTokenAuthentication allowUntrustedRsaIssuers="true" /> <serviceCertificate findValue="WCFTestCert" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /> </serviceCredentials> </behavior> </serviceBehaviors> </behaviors> </system.serviceModel> </configuration>
在这里，我们指定了一个特殊的binding(wsFederationHttpBinding)这是专用于WCS的。并且我们声明了当前应用程序需要两部分信息，一个是emailaddress，一个是givename需要注意的是，我们需要在服务端设置证书，并且在endpoint对其进行引用，这是什么道理呢? 因为客户端也要对服务进行验证。第二部分：客户端部分
1. 服务契约using System.ServiceModel; namespace HelloService { [ServiceContract] public interface IHello { [OperationContract] string Say(); } }
2. 客户端代码using System; using System.ServiceModel; namespace Client { class Program { static void Main(string[] args) { Console.WriteLine("Hit any key when service is ready"); Console.ReadKey(); ChannelFactory<HelloService.IHello> cnFactory = new ChannelFactory<HelloService.IHello>("helloClient"); HelloService.IHello chn = cnFactory.CreateChannel(); Console.WriteLine(chn.Say()); // Clean up cnFactory.Close(); // close the client’s channel Console.WriteLine("Press <Enter> to finish"); Console.ReadLine(); } } }
3. 客户端配置
<?xml version="1.0" encoding="utf-8" ?> <configuration> <system.serviceModel> <client> <endpoint name="helloClient" address="http://localhost:4123/helloService/helloEndpoint" contract="HelloService.IHello" binding="wsFederationHttpBinding" bindingConfiguration="helloFederatedBinding" behaviorConfiguration="helloClientBehavior"> <identity> <certificateReference findValue="WCFTestCert" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /> </identity> </endpoint> </client> <bindings> <wsHttpBinding> <binding name="helloBinding"> <security mode="Message"> <message clientCredentialType="IssuedToken" /> </security> </binding> </wsHttpBinding> <wsFederationHttpBinding> <binding name="helloFederatedBinding" > <security mode="Message"> <message algorithmSuite="Basic128" issuedTokenType="urn:oasis:names:tc:SAML:1.0:assertion" issuedKeyType="SymmetricKey"> <issuer address="http://schemas.xmlsoap.org/ws/2005/05/identity/issuer/self"/> <claimTypeRequirements> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/> </claimTypeRequirements> </message> </security> </binding> </wsFederationHttpBinding> </bindings> <behaviors> <endpointBehaviors> <behavior name="helloClientBehavior"> <clientCredentials> <serviceCertificate> <authentication trustedStoreLocation="CurrentUser" revocationMode="NoCheck"/> <defaultCertificate findValue="WCFTestCert" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /> </serviceCertificate> </clientCredentials> </behavior> </endpointBehaviors> </behaviors> </system.serviceModel> </configuration>
也就是说，在客户端也是需要包含证书的。一般是把不包含私钥的证书在客户端安装。
4. 运行效果
服务端
客户端
[备注]因为是Session的隔离，所以选择卡片的界面是没有办法截图的。
4. 为客户端实现异常处理
添加System.IdentityModel.Selectors引用
using System; using System.ServiceModel; using System.IdentityModel.Selectors; namespace Client { class Program { static void Main(string[] args) { try { Console.WriteLine("Hit any key when service is ready"); Console.ReadKey(); ChannelFactory<HelloService.IHello> cnFactory = new ChannelFactory<HelloService.IHello>("helloClient"); HelloService.IHello chn = cnFactory.CreateChannel(); Console.WriteLine(chn.Say()); cnFactory.Close(); } catch (UserCancellationException) { Console.WriteLine("User cancelled"); } catch (UntrustedRecipientException) { Console.WriteLine("User does not trust the recipient"); } catch (ServiceNotStartedException) { Console.WriteLine("Cardspace service not started"); } catch (CardSpaceException cse) { Console.WriteLine("Generic Cardspace exception:" + cse.Message); } catch (Exception e) { Console.WriteLine("Other exceptions :" + e.Message); } finally { Console.WriteLine("Press <Enter> to finish"); Console.ReadLine(); } } } }
