IIS在IIS + TransportCredentialOnly/Windows auth中在basicHttpBinding中托管WCF服务+ Windows身份验证

Question

我想创建一个在IIS6中托管的WCF服务,并在IIS中禁用匿名身份验证.并且不要使用SSL.

所以我唯一的方法是使用basicHttpBinging TransportCredentialOnly,不是吗？

我创建一个虚拟目录,设置Windows Integrated Auth并取消选中"启用匿名访问".

这是我的web.config:

<system.serviceModel>
        <bindings>
            <basicHttpBinding>
                <binding name="MyBinding">
                    <security mode="TransportCredentialOnly">
                        <transport clientCredentialType="Windows" />
                    </security>
                </binding>
            </basicHttpBinding>
        </bindings>
        <services>
            <service name="Samples.ServiceFacadeService" behaviorConfiguration="ServiceFacadeServiceBehavior">
                <endpoint address="" binding="basicHttpBinding" bindingName="MyBinding"
                          contract="Samples.IServiceFacadeService">
                </endpoint>
            </service>
        </services>
    <behaviors>
        <serviceBehaviors>
            <behavior name="ServiceFacadeServiceBehavior">
                <serviceDebug includeExceptionDetailInFaults="true"/>
            </behavior>
        </serviceBehaviors>
    </behaviors>
</system.serviceModel>

您可以看到我甚至没有将MEX-enpoint包含在元数据交换中.使用TransportCredentialOnly安全性只有一个端点和一个绑定.

但是当我尝试启动服务(通过客户端代理调用方法)时,我在EventLog中遇到了这样的异常:

异常:System.ServiceModel.ServiceActivationException:由于编译期间发生异常,无法激活服务'/wcftest/ServiceFacadeService.svc'.异常消息是:该服务的安全设置需要"匿名"身份验证,但它没有为承载此服务的IIS应用程序启用.. ---> System.NotSupportedException:该服务的安全设置需要"匿名"身份验证,但它没有为承载此服务的IIS应用程序启用.

我不知道为什么我的服务需要Anonymous auth？为什么？

Answer 1

答案发现了jezell.谢谢.我混合了bindingName和bindingConfiguration:

<endpoint address="" binding="basicHttpBinding" bindingName="MyBinding"
          contract="Samples.IServiceFacadeService">
</endpoint>

那就对了:

<endpoint address="" binding="basicHttpBinding" **bindingConfiguration**="MyBinding"
          contract="Samples.IServiceFacadeService">
</endpoint>

Answer 2

MEX终结点可能仍然是问题(见本岗位).尝试禁用这样的MEX:

<services>
    <!-- Note: the service name must match the configuration name for the service implementation. -->
    <service name="MyNamespace.MyServiceType" behaviorConfiguration="MyServiceTypeBehaviors" >
        <!-- Add the following endpoint.  -->
        <!-- Note: your service must have an http base address to add this endpoint. -->
        <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" />
    </service>
</services>

<behaviors>
    <serviceBehaviors>
        <behavior name="MyServiceTypeBehaviors" >
            <!-- This disables it. -->
            <serviceMetadata httpGetEnabled="false" />
        </behavior>
    </serviceBehaviors>
</behaviors>

这是关于保护MEX 的好帖子.