如何：创建自定义客户端标识验证工具

  • 项目

使用 Windows Communication Foundation (WCF) 的标识功能，客户端可以提前指定服务的预期标识。 无论服务器何时向客户端验证其自身身份，都将检查该标识是否为所需的标识。 （有关标识及其工作原理的说明，请参阅服务标识和身份验证。）

如果需要，可使用自定义标识验证工具自定义该验证。 例如，您可以执行其他服务标识验证检查。 在本示例中，自定义标识验证工具将检查从服务器返回的 X.509 证书中的其他声明。 有关示例应用程序，请参阅服务标识示例。

扩展 EndpointIdentity 类

  1. 定义一个从 EndpointIdentity 类派生的新类。 本示例将此扩展命名为 OrgEndpointIdentity。

  2. 添加私有成员和属性，扩展的 IdentityVerifier 类将使用这些属性根据从服务返回的安全令牌中的声明执行标识检查。 本示例定义一个属性：OrganizationClaim 属性。

    public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

    Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

扩展 IdentityVerifier 类

  1. 定义一个从 IdentityVerifier 派生的新类。 本示例将此扩展命名为 CustomIdentityVerifier。

    public class CustomIdentityVerifier : IdentityVerifier
{
    // Code to be added.
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        throw new Exception("The method or operation is not implemented.");
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        throw new Exception("The method or operation is not implemented.");
    }
}

    Public Class CustomIdentityVerifier
    Inherits IdentityVerifier
    ' Code to be added.

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function
End Class

  2. 重写 CheckAccess 方法。 该方法确定标识检查是成功还是失败。

  3. CheckAccess 方法有两个参数。 第一个参数是 EndpointIdentity 类的一个实例。 第二个参数是 AuthorizationContext 类的一个实例。

    在方法的实现过程中，检查 ClaimSets 类的 AuthorizationContext 属性返回的声明集合，并根据需要执行身份验证检查。 本示例首先查找类型为“可分辨名称”的任何声明，然后将此名称与 EndpointIdentity 扩展的名称 (OrgEndpointIdentity) 进行比较。

    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
{
    bool returnvalue = false;

    foreach (ClaimSet claimset in authContext.ClaimSets)
    {
        foreach (Claim claim in claimset)
        {
            if (claim.ClaimType == "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
            {
                X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                {
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                    Console.WriteLine("Right: {0}", claim.Right);
                    Console.WriteLine("Resource: {0}", claim.Resource);
                    Console.WriteLine();
                    returnvalue = true;
                }
            }
        }
    }
    return returnvalue;
}

    
Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                      ByVal authContext As AuthorizationContext) As Boolean

    Dim returnvalue = False
    For Each claimset In authContext.ClaimSets
        For Each claim In claimset
            If claim.ClaimType = "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                Dim name = CType(claim.Resource, X500DistinguishedName)
                If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                    Console.WriteLine("Right: {0}", claim.Right)
                    Console.WriteLine("Resource: {0}", claim.Resource)
                    Console.WriteLine()
                    returnvalue = True
                End If
            End If
        Next claim
    Next claimset
    Return returnvalue

End Function

实现 TryGetIdentity 方法

  1. 实现 TryGetIdentity 方法，该方法确定客户端是否可返回 EndpointIdentity 类的实例。 WCF 基础结构首先调用 TryGetIdentity 方法的实现来检索消息中的服务标识。 然后，该基础结构使用返回的 CheckAccess 和 EndpointIdentity 调用 AuthorizationContext 实现。

  2. 在 TryGetIdentity 方法中，添加以下代码：

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
{
    return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
}

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                         <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
    Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
End Function

实现自定义绑定并设置自定义标识验证工具

  1. 创建一个返回 Binding 对象的方法。 本示例首先创建 WSHttpBinding 类的一个实例，然后将其安全模式设置为 Message，并且将其 ClientCredentialType 设置为 None。

  2. 使用 BindingElementCollection 方法创建一个 CreateBindingElements。

  3. 从集合返回 SecurityBindingElement，并将其强制转换为一个 SymmetricSecurityBindingElement 变量。

  4. 将 IdentityVerifier 类的 LocalClientSecuritySettings 属性设置为先前创建的 CustomIdentityVerifier 类的一个新实例。

    public static Binding CreateCustomSecurityBinding()
{
    WSHttpBinding binding = new WSHttpBinding(SecurityMode.Message);
    //Clients are anonymous to the service.
    binding.Security.Message.ClientCredentialType = MessageCredentialType.None;
    //Secure conversation is turned off for simplification. If secure conversation is turned on, then
    //you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
    binding.Security.Message.EstablishSecurityContext = false;

    // Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    BindingElementCollection outputBec = binding.CreateBindingElements();
    SymmetricSecurityBindingElement ssbe = (SymmetricSecurityBindingElement)outputBec.Find<SecurityBindingElement>();

    //Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = new CustomIdentityVerifier();

    return new CustomBinding(outputBec);
}

    Public Shared Function CreateCustomSecurityBinding() As Binding
    Dim binding As New WSHttpBinding(SecurityMode.Message)

    With binding.Security.Message
        'Clients are anonymous to the service.
        .ClientCredentialType = MessageCredentialType.None
        'Secure conversation is turned off for simplification. If secure conversation is turned on, then 
        'you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
        .EstablishSecurityContext = False
    End With
    ' Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    Dim outputBec = binding.CreateBindingElements()
    Dim ssbe = CType(outputBec.Find(Of SecurityBindingElement)(), SymmetricSecurityBindingElement)

    'Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = New CustomIdentityVerifier()

    Return New CustomBinding(outputBec)
End Function

  5. 使用返回的自定义绑定创建客户端和类的一个实例。 然后，客户端可执行服务的自定义标识验证检查，如以下代码中所示。

    using (CalculatorClient client = new CalculatorClient(customSecurityBinding, serviceAddress))
{

    Using client As New CalculatorClient(customSecurityBinding, serviceAddress)

示例 1

下面的示例演示 IdentityVerifier 类的完整实现。

class CustomIdentityVerifier : IdentityVerifier
{
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        bool returnvalue = false;

        foreach (ClaimSet claimset in authContext.ClaimSets)
        {
            foreach (Claim claim in claimset)
            {
                if (claim.ClaimType == "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
                {
                    X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                    if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                    {
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                        Console.WriteLine("Right: {0}", claim.Right);
                        Console.WriteLine("Resource: {0}", claim.Resource);
                        Console.WriteLine();
                        returnvalue = true;
                    }
                }
            }
        }
        return returnvalue;
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
    }
}

Friend Class CustomIdentityVerifier
    Inherits IdentityVerifier

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean

        Dim returnvalue = False
        For Each claimset In authContext.ClaimSets
            For Each claim In claimset
                If claim.ClaimType = "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                    Dim name = CType(claim.Resource, X500DistinguishedName)
                    If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                        Console.WriteLine("Right: {0}", claim.Right)
                        Console.WriteLine("Resource: {0}", claim.Resource)
                        Console.WriteLine()
                        returnvalue = True
                    End If
                End If
            Next claim
        Next claimset
        Return returnvalue

    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
    End Function

End Class

示例 2

下面的示例演示 EndpointIdentity 类的完整实现。

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

另请参阅