Tutorial: Mengakses Layanan WSE 3.0 dengan Klien WCF

Artikel
04/06/2023

Klien Windows Communication Foundation (WCF) kompatibel tingkat kawat dengan layanan Web Enhancements (WSE) 3.0 untuk Microsoft .NET ketika klien WCF dikonfigurasi untuk menggunakan versi Agustus 2004 dari spesifikasi WS-Addressing. Namun, layanan WSE 3.0 tidak mendukung protokol pertukaran metadata (MEX), jadi ketika Anda menggunakan ServiceModel Metadata Utility Tool (Svcutil.exe) untuk membuat kelas klien WCF, pengaturan keamanan tidak diterapkan ke klien WCF yang dihasilkan. Oleh karena itu, Anda harus menentukan pengaturan keamanan yang diperlukan layanan WSE 3.0 setelah klien WCF dibuat.

Anda dapat menerapkan pengaturan keamanan ini dengan menggunakan pengikatan kustom untuk mempertimbangkan persyaratan layanan WSE 3.0 dan persyaratan yang dapat dioperasikan antara layanan WSE 3.0 dan klien WCF. Persyaratan interoperabilitas ini termasuk penggunaan spesifikasi WS-Addressing Agustus 2004 dan perlindungan pesan WSE 3.0default dari SignBeforeEncrypt. Perlindungan pesan default untuk WCF adalah SignBeforeEncryptAndEncryptSignature. Topik ini merinci cara membuat pengikatan WCF yang beroperasi dengan layanan WSE 3.0. WCF juga menyediakan sampel yang menggabungkan pengikatan ini. Untuk informasi selengkapnya tentang sampel ini, lihat Mengoperasikan dengan ASMX Web Services.

Tutorial: Mengakses Layanan WSE 3.0 dengan Klien WCF

Jalankan Alat Utilitas Metadata ServiceModel (Svcutil.exe) untuk membuat klien WCF untuk layanan Web WSE 3.0.

Untuk layanan Web WSE 3.0, kelas klien WCF dibuat. Karena WSE 3.0 tidak mendukung protokol MEX, Anda tidak dapat menggunakan alat ini untuk mengambil persyaratan keamanan untuk layanan Web. Pengembang aplikasi harus menambahkan pengaturan keamanan untuk klien.

Untuk detail tentang membuat klien WCF, lihat Tutorial: Membuat Klien.

Buat kelas yang mewakili pengikatan yang dapat berkomunikasi dengan layanan Web WSE 3.0.

Kelas berikut adalah bagian dari sampel Berinteroperasi dengan WSE:

Buat kelas yang berasal dari kelas Binding.

Contoh kode berikut membuat kelas bernama WseHttpBinding yang berasal dari kelas Binding.
```
public class WseHttpBinding : Binding
{
```
```
Public Class WseHttpBinding
    Inherits Binding
```

Tambahkan properti ke kelas yang menentukan pernyataan turnkey WSE digunakan oleh layanan WSE, apakah kunci turunan diperlukan, apakah sesi aman digunakan, apakah konfirmasi tanda tangan diperlukan, dan pengaturan perlindungan pesan. Dalam WSE 3.0, pernyataan turnkey menentukan persyaratan keamanan untuk klien atau layanan Web—mirip dengan mode autentikasi pengikatan di WCF.

Contoh kode berikut mendefinisikan properti SecurityAssertion, RequireDerivedKeys, EstablishSecurityContext, dan MessageProtectionOrder yang menentukan pernyataan turnkey WSE, apakah kunci turunan diperlukan, apakah sesi aman digunakan, apakah konfirmasi tanda tangan diperlukan, dan pengaturan perlindungan pesan secara berturut-turut.


private WseSecurityAssertion assertion;
public WseSecurityAssertion SecurityAssertion
{
    get { return assertion; }
    set { assertion = value; }
}

private bool requireDerivedKeys;
public bool RequireDerivedKeys
{
    get { return requireDerivedKeys; }
    set { requireDerivedKeys = value; }
}

private bool establishSecurityContext;
public bool EstablishSecurityContext
{
    get { return establishSecurityContext; }
    set { establishSecurityContext = value; }
}

private bool requireSignatureConfirmation;
public bool RequireSignatureConfirmation
{
    get { return requireSignatureConfirmation; }
    set { requireSignatureConfirmation = value; }
}

private MessageProtectionOrder messageProtectionOrder;
public MessageProtectionOrder MessageProtectionOrder
{
    get { return messageProtectionOrder; }
    set { messageProtectionOrder = value; }
}

Public Property SecurityAssertion() As WseSecurityAssertion

    Get

        Return assertion

    End Get
    Set(ByVal value As WseSecurityAssertion)

        assertion = value

    End Set

End Property

Private m_requireDerivedKeys As Boolean
Public Property RequireDerivedKeys() As Boolean

    Get

        Return m_requireDerivedKeys

    End Get
    Set(ByVal value As Boolean)

        m_requireDerivedKeys = value

    End Set

End Property

Private m_establishSecurityContext As Boolean
Public Property EstablishSecurityContext() As Boolean

    Get

        Return m_establishSecurityContext

    End Get
    Set(ByVal value As Boolean)

        m_establishSecurityContext = value

    End Set

End Property

Private m_requireSignatureConfirmation As Boolean
Public Property RequireSignatureConfirmation() As Boolean

    Get

        Return m_requireSignatureConfirmation

    End Get
    Set(ByVal value As Boolean)

        m_requireSignatureConfirmation = value

    End Set

End Property

Private m_messageProtectionOrder As MessageProtectionOrder
Public Property MessageProtectionOrder() As MessageProtectionOrder

    Get

        Return m_messageProtectionOrder

    End Get
    Set(ByVal value As MessageProtectionOrder)

        m_messageProtectionOrder = value

    End Set

End Property

Ambil alih metode CreateBindingElements untuk mengatur properti pengikatan.

Contoh kode berikut menentukan pengaturan transportasi, pengodean pesan, dan perlindungan pesan dengan mendapatkan nilai properti SecurityAssertion dan MessageProtectionOrder.

public override BindingElementCollection CreateBindingElements()
{
    //SecurityBindingElement sbe = bec.Find<SecurityBindingElement>();
    BindingElementCollection bec = new BindingElementCollection();
    // By default http transport is used
    SecurityBindingElement securityBinding;
    BindingElement transport;

    switch (assertion)
    {
        case WseSecurityAssertion.UsernameOverTransport:
            transport = new HttpsTransportBindingElement();
            securityBinding = (TransportSecurityBindingElement)SecurityBindingElement.CreateUserNameOverTransportBindingElement();
            if (establishSecurityContext == true)
                throw new InvalidOperationException("Secure Conversation is not supported for this Security Assertion Type");
            if (requireSignatureConfirmation == true)
                throw new InvalidOperationException("Signature Confirmation is not supported for this Security Assertion Type");
            break;
        case WseSecurityAssertion.MutualCertificate10:
            transport = new HttpTransportBindingElement();
            securityBinding = SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10);
            if (requireSignatureConfirmation == true)
                throw new InvalidOperationException("Signature Confirmation is not supported for this Security Assertion Type");
            ((AsymmetricSecurityBindingElement)securityBinding).MessageProtectionOrder = messageProtectionOrder;
            break;
        case WseSecurityAssertion.UsernameForCertificate:
            transport = new HttpTransportBindingElement();
            securityBinding = (SymmetricSecurityBindingElement)SecurityBindingElement.CreateUserNameForCertificateBindingElement();
            // We want signatureconfirmation on the bootstrap process
            // either for the application messages or for the RST/RSTR
            ((SymmetricSecurityBindingElement)securityBinding).RequireSignatureConfirmation = requireSignatureConfirmation;
            ((SymmetricSecurityBindingElement)securityBinding).MessageProtectionOrder = messageProtectionOrder;
            break;
        case WseSecurityAssertion.AnonymousForCertificate:
            transport = new HttpTransportBindingElement();
            securityBinding = (SymmetricSecurityBindingElement)SecurityBindingElement.CreateAnonymousForCertificateBindingElement();
            ((SymmetricSecurityBindingElement)securityBinding).RequireSignatureConfirmation = requireSignatureConfirmation;
            ((SymmetricSecurityBindingElement)securityBinding).MessageProtectionOrder = messageProtectionOrder;
            break;
        case WseSecurityAssertion.MutualCertificate11:
            transport = new HttpTransportBindingElement();
            securityBinding = SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11);
            ((SymmetricSecurityBindingElement)securityBinding).RequireSignatureConfirmation = requireSignatureConfirmation;
            ((SymmetricSecurityBindingElement)securityBinding).MessageProtectionOrder = messageProtectionOrder;
            break;
        case WseSecurityAssertion.Kerberos:
            transport = new HttpTransportBindingElement();
            securityBinding = (SymmetricSecurityBindingElement)SecurityBindingElement.CreateKerberosBindingElement();
            ((SymmetricSecurityBindingElement)securityBinding).RequireSignatureConfirmation = requireSignatureConfirmation;
            ((SymmetricSecurityBindingElement)securityBinding).MessageProtectionOrder = messageProtectionOrder;
            break;
        default:
            throw new NotSupportedException("This supplied Wse security assertion is not supported");
    }
    //Set defaults for the security binding
    securityBinding.IncludeTimestamp = true;

    // Derived Keys
    // set the preference for derived keys before creating SecureConversationBindingElement
    securityBinding.SetKeyDerivation(requireDerivedKeys);

    //Secure Conversation
    if (establishSecurityContext == true)
    {
        SymmetricSecurityBindingElement secureconversation =
                (SymmetricSecurityBindingElement)SymmetricSecurityBindingElement.CreateSecureConversationBindingElement(
                                            securityBinding, false);
        // This is the default
        //secureconversation.DefaultProtectionLevel = ProtectionLevel.EncryptAndSign;

        //Set defaults for the secure conversation binding
        secureconversation.DefaultAlgorithmSuite = SecurityAlgorithmSuite.Basic256;
        // We do not want signature confirmation on the application level messages
        // when secure conversation is enabled.
        secureconversation.RequireSignatureConfirmation = false;
        secureconversation.MessageProtectionOrder = messageProtectionOrder;
        secureconversation.SetKeyDerivation(requireDerivedKeys);
        securityBinding = secureconversation;
    }

    // Add the security binding to the binding collection
    bec.Add(securityBinding);

    // Add the message encoder.
    TextMessageEncodingBindingElement textelement = new TextMessageEncodingBindingElement();
    textelement.MessageVersion = MessageVersion.Soap11WSAddressingAugust2004;
    //These are the defaults required for WSE
    //textelement.MessageVersion = MessageVersion.Soap11Addressing1;
    //textelement.WriteEncoding = System.Text.Encoding.UTF8;
    bec.Add(textelement);

    // Add the transport
    bec.Add(transport);

    // return the binding elements
    return bec;
}

Public Overloads Overrides Function CreateBindingElements() As BindingElementCollection

    'SecurityBindingElement sbe = bec.Find<SecurityBindingElement>();
    Dim bec As New BindingElementCollection()
    ' By default http transport is used
    Dim securityBinding As SecurityBindingElement
    Dim transport As BindingElement

    Select Case assertion

        Case WseSecurityAssertion.UsernameOverTransport
            transport = New HttpsTransportBindingElement()
            securityBinding = DirectCast(SecurityBindingElement.CreateUserNameOverTransportBindingElement(), TransportSecurityBindingElement)
            If m_establishSecurityContext = True Then
                Throw New InvalidOperationException("Secure Conversation is not supported for this Security Assertion Type")
            End If
            If m_requireSignatureConfirmation = True Then
                Throw New InvalidOperationException("Signature Confirmation is not supported for this Security Assertion Type")
            End If
            Exit Select
        Case WseSecurityAssertion.MutualCertificate10
            transport = New HttpTransportBindingElement()
            securityBinding = SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10)
            If m_requireSignatureConfirmation = True Then
                Throw New InvalidOperationException("Signature Confirmation is not supported for this Security Assertion Type")
            End If
            DirectCast(securityBinding, AsymmetricSecurityBindingElement).MessageProtectionOrder = m_messageProtectionOrder
            Exit Select
        Case WseSecurityAssertion.UsernameForCertificate
            transport = New HttpTransportBindingElement()
            securityBinding = DirectCast(SecurityBindingElement.CreateUserNameForCertificateBindingElement(), SymmetricSecurityBindingElement)
            ' We want signatureconfirmation on the bootstrap process
            ' either for the application messages or for the RST/RSTR
            DirectCast(securityBinding, SymmetricSecurityBindingElement).RequireSignatureConfirmation = m_requireSignatureConfirmation
            DirectCast(securityBinding, SymmetricSecurityBindingElement).MessageProtectionOrder = m_messageProtectionOrder
            Exit Select
        Case WseSecurityAssertion.AnonymousForCertificate
            transport = New HttpTransportBindingElement()
            securityBinding = DirectCast(SecurityBindingElement.CreateAnonymousForCertificateBindingElement(), SymmetricSecurityBindingElement)
            DirectCast(securityBinding, SymmetricSecurityBindingElement).RequireSignatureConfirmation = m_requireSignatureConfirmation
            DirectCast(securityBinding, SymmetricSecurityBindingElement).MessageProtectionOrder = m_messageProtectionOrder
            Exit Select
        Case WseSecurityAssertion.MutualCertificate11
            transport = New HttpTransportBindingElement()
            securityBinding = SecurityBindingElement.CreateMutualCertificateBindingElement(MessageSecurityVersion.WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11)
            DirectCast(securityBinding, SymmetricSecurityBindingElement).RequireSignatureConfirmation = m_requireSignatureConfirmation
            DirectCast(securityBinding, SymmetricSecurityBindingElement).MessageProtectionOrder = m_messageProtectionOrder
            Exit Select
        Case WseSecurityAssertion.Kerberos
            transport = New HttpTransportBindingElement()
            securityBinding = DirectCast(SecurityBindingElement.CreateKerberosBindingElement(), SymmetricSecurityBindingElement)
            DirectCast(securityBinding, SymmetricSecurityBindingElement).RequireSignatureConfirmation = m_requireSignatureConfirmation
            DirectCast(securityBinding, SymmetricSecurityBindingElement).MessageProtectionOrder = m_messageProtectionOrder
            Exit Select
        Case Else
            Throw New NotSupportedException("This supplied Wse security assertion is not supported")

    End Select

    'Set defaults for the security binding
    securityBinding.IncludeTimestamp = True

    ' Derived Keys
    ' Set the preference for derived keys before creating the binding for SecureConversation.
    securityBinding.SetKeyDerivation(m_requireDerivedKeys)

    'Secure Conversation
    If m_establishSecurityContext = True Then

        Dim secureconversation As SymmetricSecurityBindingElement = DirectCast(SymmetricSecurityBindingElement.CreateSecureConversationBindingElement(securityBinding, False), SymmetricSecurityBindingElement)
        ' This is the default
        'secureconversation.DefaultProtectionLevel = ProtectionLevel.EncryptAndSign;

        'Set defaults for the secure conversation binding
        secureconversation.DefaultAlgorithmSuite = SecurityAlgorithmSuite.Basic256
        ' We do not want signature confirmation on the application level messages
        ' when secure conversation is enabled.
        secureconversation.RequireSignatureConfirmation = False
        secureconversation.MessageProtectionOrder = m_messageProtectionOrder
        secureconversation.SetKeyDerivation(m_requireDerivedKeys)
        securityBinding = secureconversation

    End If

    ' Add the security binding to the binding collection
    bec.Add(securityBinding)

    ' Add the message encoder.
    Dim textelement As New TextMessageEncodingBindingElement()
    textelement.MessageVersion = System.ServiceModel.Channels.MessageVersion.Soap11WSAddressingAugust2004
    'These are the defaults required for WSE
    'textelement.MessageVersion = MessageVersion.Soap11Addressing1;
    'textelement.WriteEncoding = System.Text.Encoding.UTF8;
    bec.Add(textelement)

    ' Add the transport
    bec.Add(transport)

    ' return the binding elements
    Return bec

End Function

Dalam kode aplikasi klien, tambahkan kode untuk mengatur properti pengikatan.

Contoh kode berikut menentukan bahwa klien WCF harus menggunakan perlindungan dan autentikasi pesan seperti yang ditentukan oleh pernyataan keamanan turnkey WSE 3.0 AnonymousForCertificate. Selain itu, diperlukan sesi yang aman dan kunci turunan.

static void CallWseService(bool usePolicyFile)
{
    EndpointAddress address = new EndpointAddress(new Uri("http://localhost/WSSecurityAnonymousPolicy/WSSecurityAnonymousService.asmx"),
                                                  EndpointIdentity.CreateDnsIdentity("WSE2QuickStartServer"));

    WseHttpBinding binding = new WseHttpBinding();
    if (!usePolicyFile)
    {
        binding.SecurityAssertion = WseSecurityAssertion.AnonymousForCertificate;
        binding.EstablishSecurityContext = true;
        binding.RequireDerivedKeys = true;
        binding.MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt;
    }
    else
    {
        binding.LoadPolicy("..\\wse3policyCache.config", "ServerPolicy");
    }

    WSSecurityAnonymousServiceSoapClient client = new WSSecurityAnonymousServiceSoapClient(binding, address);

Private Shared Sub CallWseService(ByVal usePolicyFile As Boolean)

    Dim address As New EndpointAddress(New Uri("http://localhost/WSSecurityAnonymousPolicy/WSSecurityAnonymousService.asmx"), EndpointIdentity.CreateDnsIdentity("WSE2QuickStartServer"))

    Dim binding As New WseHttpBinding()
    If Not usePolicyFile Then

        binding.SecurityAssertion = WseSecurityAssertion.AnonymousForCertificate
        binding.EstablishSecurityContext = True
        binding.RequireDerivedKeys = True
        binding.MessageProtectionOrder = MessageProtectionOrder.SignBeforeEncrypt

    Else
        binding.LoadPolicy("..\wse3policyCache.config", "ServerPolicy")
    End If

    Dim client As New WSSecurityAnonymousServiceSoapClient(binding, address)

Contoh

Contoh kode berikut mendefinisikan pengikatan kustom yang mengekspos properti yang sesuai dengan properti pernyataan keamanan turnkey WSE 3.0. Pengikatan kustom tersebut, yang diberi nama WseHttpBinding, kemudian digunakan untuk menentukan properti pengikatan untuk klien WCF yang berkomunikasi dengan sampel Mulai Cepat WSSecurityAnonymous WSE 3.0.

Bagikan melalui

Tutorial: Mengakses Layanan WSE 3.0 dengan Klien WCF

Tutorial: Mengakses Layanan WSE 3.0 dengan Klien WCF

Contoh

Lihat juga

Sumber Daya Tambahan: