WCF基于用户名和密码安全成功测试
目标：
１.客户端与服务器端通信使用x509证书验证，但不用客户端安装证书。只需要服务器端配置好证书即可。
２.验证使用用户名密码形式。
操作：
（这里的测试使用wcf项目模板缺省的服务，即只要新建一个使用vs2008自动生成的wcf项目就行了，
它会自动生成有一个GetData方法，我就用这个方法进行测试）
1.新建WCF服务应用程序.
1.1生成一个服务器证书：运行Visual Studio 2008 命令提示工具：
输入：makecert -r -pe -n "CN=MyServer" -sr LocalMachine -ss My -sky exchange执行。
-sr LocalMachine 请一定保存到LodcalMachine中.目的就是到时如果你部署这个wcf服务的时候可以让IIS找到证书，
反之，IIS会报找不到x509证书.
2.配置web.config文件：
这里要注意的是把storeLocation设为LocalMachine,原因也是到时需要部署的时候可以免掉很多麻烦，因为以后发布到iis时很可以不能正常验证到证书的私钥.
1: <system.serviceModel>
2: <bindings>
3: <wsHttpBinding>
4: <binding name="NewBinding0">
5: <security>
6: <message clientCredentialType="UserName" />
7: </security>
8: </binding>
9: </wsHttpBinding>
10: </bindings>
11: <services>
12: <service behaviorConfiguration="WcfService2.Service1Behavior"
13: name="WcfService2.Service1">
14: <endpoint address="" binding="wsHttpBinding" bindingConfiguration="NewBinding0"
15: contract="WcfService2.IService1">
16: </endpoint>
17: <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
18: </service>
19: </services>
20: <behaviors>
21: <serviceBehaviors>
22: <behavior name="WcfService2.Service1Behavior">
23: <serviceMetadata httpGetEnabled="true" />
24: <serviceDebug includeExceptionDetailInFaults="false" />
25: <serviceCredentials>
26: <clientCertificate>
27: <authentication certificateValidationMode="None" />
28: </clientCertificate>
29: <serviceCertificate findValue="MyServer" storeLocation="LocalMachine" x509FindType="FindBySubjectName" />
30: <userNameAuthentication userNamePasswordValidationMode="Custom"
31: customUserNamePasswordValidatorType="WcfService2.MyUserNamePasswordValidator,WcfService2" />
32: </serviceCredentials>
33: </behavior>
34: </serviceBehaviors>
35: </behaviors>
36: </system.serviceModel>
3.建造验证客户端用户名和密码的方法.
这里注意的是必须与web.config文件中的customUserNamePasswordValidatorType=中的内容一致，
格式是："命名空间.方法名,命名空间"
实际项目应用中这里应该是从数据库里确认用客是否合法。
1: namespace WcfService2
2: {
3: public class MyUserNamePasswordValidator : UserNamePasswordValidator
4: {
5: public override void Validate(string userName, string password)
6: {
7: if (userName != "jac" || password != "jac")
8: {
9: throw new SecurityTokenException("Unknown Username or Password");
10: }
11: }
12: }
13: }
至此，wcf服务配置完成。
4.新建一个asp.net项目，并添加服务引用这个wcf服务.
5.修改asp.net项目的web.config文件(一定要在引用wcf服务后）.
添加一个endpointBehaviors:
1: <behaviors>
2: <endpointBehaviors>
3: <behavior name="jacBehavior">
4: <clientCredentials>
5: <serviceCertificate>
6: <authentication certificateValidationMode="None" />
7: </serviceCertificate>
8: </clientCredentials>
9: </behavior>
10: </endpointBehaviors>
11: </behaviors>
然后让它生效,
1: <endpoint address="http://j-8de9be98d1184/Service1.svc" behaviorConfiguration="jacBehavior"
2: binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService1"
3: contract="ServiceReference1.IService1" name="WSHttpBinding_IService1">
以下是完整的asp.net客户端的web.config文件的system.serviceModel部份
1: <system.serviceModel>
2: <behaviors>
3: <endpointBehaviors>
4: <behavior name="jacBehavior">
5: <clientCredentials>
6: <serviceCertificate>
7: <authentication certificateValidationMode="None" />
8: </serviceCertificate>
9: </clientCredentials>
10: </behavior>
11: </endpointBehaviors>
12: </behaviors>
13: <bindings>
14: <wsHttpBinding>
15: <binding name="WSHttpBinding_IService1" closeTimeout="00:01:00"
16: openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
17: bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
18: maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text"
19: textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
20: <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
21: maxBytesPerRead="4096" maxNameTableCharCount="16384" />
22: <reliableSession ordered="true" inactivityTimeout="00:10:00"
23: enabled="false" />
24: <security mode="Message">
25: <transport clientCredentialType="Windows" proxyCredentialType="None"
26: realm="" />
27: <message clientCredentialType="UserName" negotiateServiceCredential="true"
28: algorithmSuite="Default" establishSecurityContext="true" />
29: </security>
30: </binding>
31: </wsHttpBinding>
32: </bindings>
33: <client>
34: <endpoint address="http://j-8de9be98d1184/Service1.svc" behaviorConfiguration="jacBehavior"
35: binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService1"
36: contract="ServiceReference1.IService1" name="WSHttpBinding_IService1">
37: <identity>
38: <certificate encodedValue="AwAAAAEA.....................eGtnWJsvtFQsEuzDYw==" />
39: </identity>
40: </endpoint>
41: </client>
42: </system.serviceModel>
6.调用.
1: ServiceReference1.Service1Client sc = new WebApplication1.ServiceReference1.Service1Client();
2: sc.ClientCredentials.UserName.UserName = "jac";
3: sc.ClientCredentials.UserName.Password = "jac";
4: Label1.Text = sc.GetData(22);
完成.
工程文件下载:http://FunSL.com
为了便使这种方式自由度更高，以下是服务器端的纯代码版本:
1: using System;
2: using System.Collections.Generic;
3: using System.Linq;
4: using System.Text;
5: using System.ServiceModel;
6: using System.IdentityModel.Selectors;
7: using System.ServiceModel.Description;
8:
9: namespace wcf.username
10: {
11: class Program
12: {
13: static void Main(string[] args)
14: {
15: EndpointAddress endp = new EndpointAddress("http://localhost/myservice");
16:
17: WSHttpBinding ws = new WSHttpBinding();
18: ws.Security.Mode = SecurityMode.Message;
19: ws.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
20:
21: ServiceMetadataBehavior behavior = new ServiceMetadataBehavior();
22: behavior.HttpGetEnabled = true;
23: behavior.HttpGetUrl = new Uri("http://localhost/myservice/mex");
24:
25: ServiceHost sh = new ServiceHost(typeof(serverdo), new Uri(endp.ToString()));
26:
27: sh.Description.Behaviors.Add(behavior);
28:
29: sh.Credentials.ClientCertificate.Authentication.CertificateValidationMode =
30: System.ServiceModel.Security.X509CertificateValidationMode.None;
31:
32:
33: sh.Credentials.UserNameAuthentication.UserNamePasswordValidationMode =
34: System.ServiceModel.Security.UserNamePasswordValidationMode.Custom;
35:
36: sh.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = new checkUserName();
37:
38: sh.Credentials.ServiceCertificate.SetCertificate(
39: System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine,
40: System.Security.Cryptography.X509Certificates.StoreName.My,
41: System.Security.Cryptography.X509Certificates.X509FindType.FindBySubjectName, "MyServer");
42:
43: sh.AddServiceEndpoint(typeof(Iservice), ws, endp.ToString());
44: sh.Open();
45:
46: Console.WriteLine("ok");
47: Console.Read();
48: }
49: }
50:
51: class checkUserName:UserNamePasswordValidator
52: {
53: public override void Validate(string userName, string password)
54: {
55: if (userName != "jac" && password != "jac")
56: {
57: throw new FaultException("userName and passWord be error");
58: }
59: }
60: }
61:
62: [ServiceContract]
63: interface Iservice
64: {
65: [OperationContract]
66: string test(string msg);
67: }
68:
69: class serverdo:Iservice
70: {
71: #region Iservice 成员
72:
73: public string test(string msg)
74: {
75: Console.WriteLine("user inter:" + msg);
76:
77: return "user inter:" + msg;
78: }
79:
80: #endregion
81: }
82:
83: }
