如何为WCF应用添加X509证书和安全验证

一、首先用Visual Studio 命令提示创建证书

makecert -sr LocalMachine -ss My -a sha1 -n CN=Webabcd -sky exchange -pe

certmgr -add -r LocalMachine -s My -c -n Webabcd -s TrustedPeople

在运行处输入CertMgr.msc 打开证书管理界面就能找到我们刚才创建的证书

证书参数详情请参考：http://msdn.microsoft.com/zh-cn/library/bfsktky3.aspx

二、为WCF服务添加自定义验证（添加一个继承UserNamePasswordValidator的类并重写Validate）

/// 自定义的用户名/密码验证类
    /// </summary>
    public class CustomNamePasswordValidator : System.IdentityModel.Selectors.UserNamePasswordValidator
    {
        /// <summary>
        /// 验证指定的用户名和密码
        /// </summary>
        /// <param name="userName">要验证的用户名</param>
        /// <param name="password">要验证的密码</param>
        public override void Validate(string userName, string password)
        {
            if (!(userName == "webabcd" && password == "webabcd"))
            {
                throw new FaultException("用户名或密码不正确");
            }
        }
    }

三、为WCF宿主添加如下Config配置

<?xml version="1.0"?>
<configuration>
    <system.serviceModel>
        <services>
            
            
            <service name="WCF.ServiceLib.Security.Hello" behaviorConfiguration="SecurityBehavior">
                
                
                
                <endpoint address="" binding="wsHttpBinding" contract="WCF.ServiceLib.Security.IHello" bindingConfiguration="SecurityBindingConfiguration"  />
            </service>
        </services>
        <behaviors>
            <serviceBehaviors>
                <behavior name="SecurityBehavior">
                    
                    <serviceMetadata httpGetEnabled="true" />
                    <serviceDebug includeExceptionDetailInFaults="true"/>
                    <serviceCredentials>
                        
                        
                        
                        
                        
                        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="WCF.ServiceLib.Security.CustomNamePasswordValidator, WCF.ServiceLib" />
                        
                        
                        
                        
                        <serviceCertificate findValue="Webabcd" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
                    </serviceCredentials>
                </behavior>
            </serviceBehaviors>
        </behaviors>
        <bindings>
            <wsHttpBinding>
                <binding name="SecurityBindingConfiguration">
                    <security>
                        
                        
                        
                        <message clientCredentialType="UserName" />
                    </security>
                </binding>
            </wsHttpBinding>
        </bindings>
    </system.serviceModel>

</configuration>

四、为WCF客户端添加如下Config配置

<?xml version="1.0"?>
<configuration>
    <system.serviceModel>
        <client>
            
            
            
            
            
            <endpoint address="http://localhost:3502/ServiceHost/Security/Hello.svc"
                binding="wsHttpBinding"
                contract="SecuritySvc.IHello"
                bindingConfiguration="HelloBindingConfiguration"
                behaviorConfiguration="HelloBehaviorConfiguration">
                <identity>
                    
                    <certificate encodedValue="MIIBrzCCAV2gAwIBAgIQbKQyXm9CcqFDX4Miyg8BIzAJBgUrDgMCHQUAMBYxFDAS
BgNVBAMTC1Jvb3QgQWdlbmN5MB4XDTExMDUxNzAzMTk1NFoXDTM5MTIzMTIzNTk1
OVowEjEQMA4GA1UEAxMHV2ViYWJjZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
gYEAswtbR9PHHNr+KdqzcmlknoR8cscwcVhyMFT2pL6qPL+Lt8h6RQQqrvkybQVM
JMDO1YEK06VTBQI64v5Fbe+J/eXBD8KMIuV5Jym3QOybppvohOcFBVoEUvly3qce
WskUDTGZokrQ7QHaLZZagKBq7ZtxFHcvf4UeZW63hV+d2P0CAwEAAaNLMEkwRwYD
VR0BBEAwPoAQEuQJLQYdHU8AjWEh3BZkY6EYMBYxFDASBgNVBAMTC1Jvb3QgQWdl
bmN5ghAGN2wAqgBkihHPuNSqXDX0MAkGBSsOAwIdBQADQQBIZUMTjZSFTQYXYDA+
FdISovnpugA8ltEzkDQm7FpJee6WX/nlZzAu6reIdRZaaGnPCky23C7eix3DxIuu
+FqU" />
                </identity>
            </endpoint>
        </client>
        <bindings>
            <wsHttpBinding>
                <binding name="HelloBindingConfiguration">
                    <security>
                        
                        
                        
                        <message clientCredentialType="UserName" />
                    </security>
                </binding>
            </wsHttpBinding>
        </bindings>
        <behaviors>
            <endpointBehaviors>
                <behavior name="HelloBehaviorConfiguration">
                    <clientCredentials>
                        <serviceCertificate>
                            
                            
                            
                            
                            
                            
                            <authentication certificateValidationMode="PeerTrust" />
                        </serviceCertificate>
                    </clientCredentials>
                </behavior>
            </endpointBehaviors>
        </behaviors>
    </system.serviceModel>

</configuration>

QA：如何得到encodedValue的值？

1.把cer文件（证书）导出为base64格式

　　a,使用mmc找到需要的证书 -- (Add Snap-In)

　　b,右击证书导出

　c,base64 encoded x509(.cer)

2.用文本工具打开可得到encodedValue值

最后、客户端调用很简单，直接实例化WCF服务调用，只是在调用前要对步骤二的方法进行传参。

  using (var proxy = new SecuritySvc.HelloClient())
        {
            //此出进行验证
            proxy.ClientCredentials.UserName.UserName = txtUserName.Text;
            proxy.ClientCredentials.UserName.Password = txtPassword.Text;

            //在下面调用你的WCF方法
            proxy.SayHello("Vis");

}

posted @ 2011-05-17 12:21 leeolevis 阅读(2145) 评论(5) 编辑收藏举报

刷新页面返回顶部

Vis

如何为WCF应用添加X509证书和安全验证

公告