การฝึกอบรม
โมดูล
Explore connection security rules - Training
This module describes how connection security rules can be used to provide additional security to protect data transmitted across networks.
เบราว์เซอร์นี้ไม่ได้รับการสนับสนุนอีกต่อไป
อัปเกรดเป็น Microsoft Edge เพื่อใช้ประโยชน์จากคุณลักษณะล่าสุด เช่น การอัปเดตความปลอดภัยและการสนับสนุนด้านเทคนิค
Windows Communication Foundation (WCF) includes several system-provided bindings that can be configured but do not provide full flexibility when configuring all the security options that WCF supports. This topic demonstrates how to create a custom binding directly from individual binding elements and highlights some of the security settings that can be specified when creating such a binding. For more information about creating custom bindings, see Extending Bindings.
คำเตือน
SecurityBindingElement does not support the IDuplexSessionChannel channel shape, which is the default channel shape use by the TCP transport when TransferMode is set to Buffered. You must set TransferMode to Streamed in order to use SecurityBindingElement in this scenario.
In WCF all bindings are made up of binding elements. Each binding element derives from the BindingElement class. For the standard system-provided bindings, the binding elements are created and configured for you, although you can customize some of the property settings.
In contrast, to create a custom binding, binding elements are created and configured and a CustomBinding is created from the binding elements.
To do this, you add the individual binding elements to a collection represented by an instance of the BindingElementCollection class, and then set the Elements
property of the CustomBinding
equal to that object. You must add the binding elements in the following order: Transaction Flow, Reliable Session, Security, Composite Duplex, One-way, Stream Security, Message Encoding, and Transport. Note that not all the binding elements listed are required in every binding.
Three binding elements relate to message level security, all of which derive from the SecurityBindingElement class. The three are TransportSecurityBindingElement, SymmetricSecurityBindingElement, and AsymmetricSecurityBindingElement. The TransportSecurityBindingElement is used to provide Mixed mode security. The other two elements are used when the message layer provides security.
Additional classes are used when transport level security is provided:
There are a large number of possible binding elements that can be combined into a binding. Not all of these combinations are valid. This section describes the required elements that must be present in a security binding.
Valid security bindings depend on many factors, including the following:
Security mode.
Transport protocol.
The message exchange pattern (MEP) specified in the contract.
The following table shows the valid binding element stack configurations for each combination of the preceding factors. Note that these are minimal requirements. You can add additional binding elements to the binding, such as message encoding binding elements, transaction binding elements, and other binding elements.
Security Mode | Transport | Contract Message Exchange Pattern | Contract Message Exchange Pattern | Contract Message Exchange Pattern |
---|---|---|---|---|
Datagram |
Request Reply |
Duplex |
||
Transport | Https | |||
OneWayBindingElement | ||||
HttpsTransportBindingElement | HttpsTransportBindingElement | |||
TCP | ||||
OneWayBindingElement | ||||
SSL or Windows StreamSecurityBindingElement | SSL or Windows StreamSecurityBindingElement | SSL or Windows StreamSecurityBindingElement | ||
TcpTransportBindingElement | TcpTransportBindingElement | TcpTransportBindingElement | ||
Message | Http | SymmetricSecurityBindingElement | SymmetricSecurityBindingElement | SymmetricSecurityBindingElement (authentication mode = SecureConversation) |
CompositeDuplexBindingElement | ||||
OneWayBindingElement | OneWayBindingElement | |||
HttpTransportBindingElement | HttpTransportBindingElement | HttpTransportBindingElement | ||
Tcp | SecurityBindingElement | SecurityBindingElement | SymmetricSecurityBindingElement (authentication mode = SecureConversation) | |
TcpTransportBindingElement | TcpTransportBindingElement | TcpTransportBindingElement | ||
Mixed (transport with message credentials) | Https | TransportSecurityBindingElement | TransportSecurityBindingElement | |
OneWayBindingElement | ||||
HttpsTransportBindingElement | HttpsTransportBindingElement | |||
TCP | TransportSecurityBindingElement | SymmetricSecurityBindingElement (authentication mode = SecureConversation) | SymmetricSecurityBindingElement (authentication mode = SecureConversation) | |
OneWayBindingElement | ||||
SSL or Windows StreamSecurityBindingElement | SSL or Windows StreamSecurityBindingElement | SSL or Windows StreamSecurityBindingElement | ||
TcpTransportBindingElement | TcpTransportBindingElement | TcpTransportBindingElement |
Note that there are many configurable settings on the SecurityBindingElements. For more information, see SecurityBindingElement Authentication Modes.
For more information, see Secure Conversations and Secure Sessions.
Create an instance of the BindingElementCollection class with the name outputBec
.
Call the static method M:System.ServiceModel.Channels.SecurityBindingElement.CreateSspiNegotiationBindingElement(true)
, which returns an instance of the SymmetricSecurityBindingElement class.
Add the SymmetricSecurityBindingElement to the collection (outputBec
) by calling the Add
method of the Collection<T> of BindingElement class.
Create an instance of the TextMessageEncodingBindingElement class and add it to the collection (outputBec
). This specifies the encoding used by the binding.
Create a HttpTransportBindingElement and add it to the collection (outputBec
). This specifies that the binding uses the HTTP transport.
Create a new custom binding by creating an instance of the CustomBinding class and passing the collection outputBec
to the constructor.
The resulting custom binding shares many of the same characteristics as the standard WSHttpBinding. It specifies message-level security and Windows credentials but disables secure sessions, requires that the service credential be specified out-of-band, and does not encrypt signatures. The last can be controlled only by setting the MessageProtectionOrder property as shown in step 4. The other two can be controlled using settings on the standard binding.
The following example provides a complete function to create a custom binding that uses a SymmetricSecurityBindingElement.
// Create an empty CustomBinding to populate
CustomBinding binding = new CustomBinding();
// Create a SymmetricSecurityBindingElement.
SymmetricSecurityBindingElement ssbe =
SecurityBindingElement.CreateSspiNegotiationBindingElement(true);
// Add the SymmetricSecurityBindingElement to the BindingElementCollection.
binding.Elements.Add(ssbe);
binding.Elements.Add(new TextMessageEncodingBindingElement());
binding.Elements.Add(new HttpTransportBindingElement());
return new CustomBinding(binding);
Public Shared Function CreateCustomBinding() As Binding
' Create an empty Custom Binding to populate,
Dim binding As New CustomBinding()
' Create a SymmetricSecurityBindingElement.
Dim ssbe As SymmetricSecurityBindingElement
ssbe = SecurityBindingElement.CreateSspiNegotiationBindingElement(True)
' Add the SymmetricSecurityBindingElement to the BindingElementCollection.
binding.Elements.Add(ssbe)
binding.Elements.Add(New TextMessageEncodingBindingElement())
binding.Elements.Add(New HttpTransportBindingElement())
Return New CustomBinding(binding)
End Function
การฝึกอบรม
โมดูล
Explore connection security rules - Training
This module describes how connection security rules can be used to provide additional security to protect data transmitted across networks.