WCF服务上的自定义基本身份验证

Question

我一直在努力争取在WCF服务上使用自定义基本身份验证，现在已经有一段时间了。

我尝试使用自定义的userNameAuthentication和自定义的serviceAuthorizationManager。

我遇到的是，我陷入了一个“循环”中，要求提供凭据，而且似乎从未获得我的自定义身份验证。根据我的研究，这似乎是因为IIS劫持了身份验证并检查本地用户。

从Web配置中，我已通过基本身份验证打开了传输安全性：

<webHttpBinding>
    <binding name="SecureBinding">
      <security mode="Transport">
        <transport clientCredentialType="Basic" />
      </security>
    </binding>
  </webHttpBinding>

相关服务行为：（我尝试将其中一项内容注释掉）

<serviceBehaviors>
    <behavior name="AuthenticatedWCF.CustomServiceBehavior">
      <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug includeExceptionDetailInFaults="true"/>
      <serviceAuthorization serviceAuthorizationManagerType="AuthenticatedWCF.Classes.Helpers.AuthenticationManager, AuthenticatedWCF" />
      <!--<serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="AuthenticatedWCF.Classes.Helpers.AuthenticationManager, AuthenticatedWCF" />
      </serviceCredentials>-->
    </behavior>
  </serviceBehaviors>

授权类（永远不会被调用）：

public class AuthenticationManager : ServiceAuthorizationManager
{
    protected override bool CheckAccessCore(OperationContext operationContext)
    {
        //Extract the Authorization header, and parse out the credentials converting the Base64 string:
        var authHeader = WebOperationContext.Current.IncomingRequest.Headers["Authorization"];

        if ((authHeader != null) && (authHeader != string.Empty))
        {
            return true;
            /*var svcCredentials = System.Text.ASCIIEncoding.ASCII
                    .GetString(Convert.FromBase64String(authHeader.Substring(6)))
                    .Split(':');

            throw new Exception(authHeader);

            var user = new { Name = svcCredentials[0], Password = svcCredentials[1] };
            if ((user.Name == "user1" && user.Password == "test"))
            {
                //User is authrized and originating call will proceed
                return true;
            }
            else
            {
                //not authorized
                return false;
            }*/
        }
        else
        {
            //No authorization header was provided, so challenge the client to provide before proceeding:
            WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate: Basic realm=AuthenticatedWCF");
            //Throw an exception with the associated HTTP status code equivalent to HTTP status 401
            //throw new WebFaultException("Please provide a username and password", HttpStatusCode.Unauthorized);
            throw new WebFaultException(HttpStatusCode.Unauthorized);
            //return false;
        }
    }
}

我想问题是，如何解决IIS的问题？

如果您需要更多详细信息，请告诉我，我们很乐意分享您可能遇到的任何问题的答案。

Answer 1

您必须在 Web 配置中关闭基本身份验证才能调用此类。基本身份验证是在您的应用程序意识到之前就由 IIS 处理的。