通过

如何：更改 X.509 证书私钥的加密提供程序

  • 项目

本主题说明如何更改用于提供 X.509 证书私钥的加密提供程序以及如何将该提供程序集成到 Windows Communication Foundation (WCF) 安全框架中。有关使用证书的更多信息，请参见使用证书。

如如何：创建自定义令牌中所述，WCF 安全框架提供了一种引入新安全令牌类型的方法。还可以使用自定义令牌替换系统提供的现有令牌类型。

在本主题中，系统提供的 X.509 安全令牌替换为自定义 X.509 令牌，此自定义令牌提供了一种不同的证书私钥的实现。当实际私钥是由默认 Windows 加密提供程序之外的其他加密提供程序提供时，这是非常有用的。可选的加密提供程序的一个示例是硬件安全模块，该模块执行所有私钥相关的加密操作并且没有将私钥存储在内存中，从而提高了系统的安全性。

下面的示例仅供演示使用。它不会替换默认的 Windows 加密提供程序，而只是演示在哪种情况下可以集成这样一个提供程序。

过程

每个具有一个或多个关联的安全密钥的安全令牌都必须实现 SecurityKeys 属性，以便从此安全令牌实例返回一个密钥集合。如果此令牌为 X.509 安全令牌，则集合包含一个 X509AsymmetricSecurityKey 类的实例，此类表示与证书关联的公钥和私钥。若要替换用于提供证书密钥的默认的加密提供程序，请创建此类的一个新实现。

创建自定义 X.509 非对称密钥

  1. 定义一个从 X509AsymmetricSecurityKey 类派生的新类。

  2. 重写 KeySize 只读属性。此属性返回证书的公钥/私钥对的实际密钥大小。

  3. 重写 DecryptKey 方法。WCF 安全框架调用此方法以使用证书的私钥来解密对称密钥。（此密钥之前使用证书的公钥进行加密。）

  4. 重写 GetAsymmetricAlgorithm 方法。WCF 安全框架调用此方法以获取 AsymmetricAlgorithm 类的实例，此类表示证书私钥或公钥的加密提供程序，具体取决于传递到此方法的参数。

  5. 可选。重写 GetHashAlgorithmForSignature 方法。如果需要 HashAlgorithm 类的另一个实现，请重写此方法。

  6. 重写 GetSignatureFormatter 方法。此方法返回与证书私钥关联的 AsymmetricSignatureFormatter 类的实例。

  7. 重写 IsSupportedAlgorithm 方法。此方法用于指示安全密钥实现是否支持某个特定的加密算法。

    Friend Class CustomX509AsymmetricSecurityKey
    Inherits X509AsymmetricSecurityKey

    Private _certificate As X509Certificate2
    Private _thisLock As New Object()
    Private _privateKeyAvailabilityDetermined As Boolean
    Private _privateKey As AsymmetricAlgorithm
    Private _publicKey As PublicKey

    Public Sub New(ByVal certificate As X509Certificate2)
        MyBase.New(certificate)
        Me._certificate = certificate
    End Sub

    Public Overrides ReadOnly Property KeySize() As Integer
        Get
            Return Me.PublicKey.Key.KeySize
        End Get
    End Property

    Private Overloads ReadOnly Property PrivateKey() As AsymmetricAlgorithm
        ' You need to modify this to obtain the private key using a different cryptographic
        ' provider if you do not want to use the default provider.
        Get
            If Not Me._privateKeyAvailabilityDetermined Then
                SyncLock ThisLock
                    If Not Me._privateKeyAvailabilityDetermined Then
                        Me._privateKey = Me._certificate.PrivateKey
                        Me._privateKeyAvailabilityDetermined = True
                    End If
                End SyncLock
            End If
            Return Me._privateKey
        End Get
    End Property

    Private Overloads ReadOnly Property PublicKey() As PublicKey
        Get
            If Me._publicKey Is Nothing Then
                SyncLock ThisLock
                    If Me._publicKey Is Nothing Then
                        Me._publicKey = Me._certificate.PublicKey
                    End If
                End SyncLock
            End If
            Return Me._publicKey
        End Get
    End Property

    Private Overloads ReadOnly Property ThisLock() As Object
        Get
            Return _thisLock
        End Get
    End Property

    Public Overrides Function DecryptKey(ByVal algorithm As String, _
                                         ByVal keyData() As Byte) As Byte()
        ' You can decrypt the key only if you have the private key in the certificate.
        If Me.PrivateKey Is Nothing Then
            Throw New NotSupportedException("Missing private key")
        End If

        Dim rsa = TryCast(Me.PrivateKey, RSA)
        If rsa Is Nothing Then
            Throw New NotSupportedException("Private key cannot be used with RSA algorithm")
        End If

        ' Support exchange keySpec, AT_EXCHANGE ?
        If rsa.KeyExchangeAlgorithm Is Nothing Then
            Throw New NotSupportedException("Private key does not support key exchange")
        End If

        Select Case algorithm
            Case EncryptedXml.XmlEncRSA15Url
                Return EncryptedXml.DecryptKey(keyData, rsa, False)

            Case EncryptedXml.XmlEncRSAOAEPUrl
                Return EncryptedXml.DecryptKey(keyData, rsa, True)

            Case Else
                Throw New NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm))
        End Select
    End Function

    Public Overrides Function GetAsymmetricAlgorithm(ByVal algorithm As String, _
                                                     ByVal privateKey As Boolean) As AsymmetricAlgorithm
        If privateKey Then
            If Me.PrivateKey Is Nothing Then
                Throw New NotSupportedException("Missing private key")
            End If

            Select Case algorithm
                Case SignedXml.XmlDsigDSAUrl
                    If TryCast(Me.PrivateKey, DSA) IsNot Nothing Then
                        Return (TryCast(Me.PrivateKey, DSA))
                    End If
                    Throw New NotSupportedException("Private key cannot be used with DSA")

                Case SignedXml.XmlDsigRSASHA1Url, EncryptedXml.XmlEncRSA15Url, EncryptedXml.XmlEncRSAOAEPUrl
                    If TryCast(Me.PrivateKey, RSA) IsNot Nothing Then
                        Return (TryCast(Me.PrivateKey, RSA))
                    End If
                    Throw New NotSupportedException("Private key cannot be used with RSA")
                Case Else
                    Throw New NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm))
            End Select
        Else
            Select Case algorithm
                Case SignedXml.XmlDsigDSAUrl
                    If TryCast(Me.PublicKey.Key, DSA) IsNot Nothing Then
                        Return (TryCast(Me.PublicKey.Key, DSA))
                    End If
                    Throw New NotSupportedException("Public key cannot be used with DSA")
                Case SignedXml.XmlDsigRSASHA1Url, EncryptedXml.XmlEncRSA15Url, EncryptedXml.XmlEncRSAOAEPUrl
                    If TryCast(Me.PublicKey.Key, RSA) IsNot Nothing Then
                        Return (TryCast(Me.PublicKey.Key, RSA))
                    End If
                    Throw New NotSupportedException("Public key cannot be used with RSA")
                Case Else
                    Throw New NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm))
            End Select
        End If
    End Function

    Public Overrides Function GetHashAlgorithmForSignature(ByVal algorithm As String) As HashAlgorithm
        If Not Me.IsSupportedAlgorithm(algorithm) Then
            Throw New NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm))
        End If

        Select Case algorithm
            Case SignedXml.XmlDsigDSAUrl, SignedXml.XmlDsigRSASHA1Url
                Return New SHA1Managed()
            Case Else
                Throw New NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm))
        End Select
    End Function

    Public Overrides Function GetSignatureFormatter(ByVal algorithm As String) As AsymmetricSignatureFormatter
        ' The signature can be created only if the private key is present.
        If Me.PrivateKey Is Nothing Then
            Throw New NotSupportedException("Private key is missing")
        End If

        ' Only one of the two algorithms is supported, not both.
        '     XmlDsigDSAUrl = "http://www.w3.org/2000/09/xmldsig#dsa-sha1";
        '     XmlDsigRSASHA1Url = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
        Select Case algorithm
            Case SignedXml.XmlDsigDSAUrl

                ' Ensure that this is a DSA algorithm object.
                Dim dsa = (TryCast(Me.PrivateKey, DSA))
                If dsa Is Nothing Then
                    Throw New NotSupportedException("Private key cannot be used DSA")
                End If

                Return New DSASignatureFormatter(dsa)

            Case SignedXml.XmlDsigRSASHA1Url
                ' Ensure that this is an RSA algorithm object.
                Dim rsa = (TryCast(Me.PrivateKey, RSA))
                If rsa Is Nothing Then
                    Throw New NotSupportedException("Private key cannot be used RSA")
                End If

                Return New RSAPKCS1SignatureFormatter(rsa)
            Case Else
                Throw New NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm))
        End Select
    End Function

    Public Overrides Function IsSupportedAlgorithm(ByVal algorithm As String) As Boolean
        Select Case algorithm
            Case SignedXml.XmlDsigDSAUrl
                Return (TypeOf Me.PublicKey.Key Is DSA)

            Case SignedXml.XmlDsigRSASHA1Url, EncryptedXml.XmlEncRSA15Url, EncryptedXml.XmlEncRSAOAEPUrl
                Return (TypeOf Me.PublicKey.Key Is RSA)

            Case Else
                Return False
        End Select
    End Function

End Class

    class CustomX509AsymmetricSecurityKey : X509AsymmetricSecurityKey
{
    X509Certificate2 certificate;
    object thisLock = new Object();
    bool privateKeyAvailabilityDetermined;
    AsymmetricAlgorithm privateKey;
    PublicKey publicKey;

    public CustomX509AsymmetricSecurityKey(X509Certificate2 certificate)
        : base(certificate)
    {
        this.certificate = certificate;
    }

    public override int KeySize
    {
        get { return this.PublicKey.Key.KeySize; }
    }

    AsymmetricAlgorithm PrivateKey
    {
        // You need to modify this to obtain the private key using a different cryptographic
        // provider if you do not want to use the default provider.
        get
        {
            if (!this.privateKeyAvailabilityDetermined)
            {
                lock (ThisLock)
                {
                    if (!this.privateKeyAvailabilityDetermined)
                    {
                        this.privateKey = this.certificate.PrivateKey;
                        this.privateKeyAvailabilityDetermined = true;
                    }
                }
            }
            return this.privateKey;
        }
    }

    PublicKey PublicKey
    {
        get
        {
            if (this.publicKey == null)
            {
                lock (ThisLock)
                {
                    if (this.publicKey == null)
                    {
                        this.publicKey = this.certificate.PublicKey;
                    }
                }
            }
            return this.publicKey;
        }
    }

    Object ThisLock
    {
        get
        {
            return thisLock;
        }
    }

    public override byte[] DecryptKey(string algorithm, byte[] keyData)
    {
        // You can decrypt the key only if you have the private key in the certificate.
        if (this.PrivateKey == null)
        {
            throw new NotSupportedException("Missing private key");
        }

        RSA rsa = this.PrivateKey as RSA;
        if (rsa == null)
        {
            throw new NotSupportedException("Private key cannot be used with RSA algorithm");
        }

        // Support exchange keySpec, AT_EXCHANGE ?
        if (rsa.KeyExchangeAlgorithm == null)
        {
            throw new NotSupportedException("Private key does not support key exchange");
        }

        switch (algorithm)
        {
            case EncryptedXml.XmlEncRSA15Url:
                return EncryptedXml.DecryptKey(keyData, rsa, false);

            case EncryptedXml.XmlEncRSAOAEPUrl:
                return EncryptedXml.DecryptKey(keyData, rsa, true);

            default:
                throw new NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm));
        }
    }

    public override AsymmetricAlgorithm GetAsymmetricAlgorithm(string algorithm, bool privateKey)
    {
        if (privateKey)
        {
            if (this.PrivateKey == null)
            {
                throw new NotSupportedException("Missing private key");
            }

            switch (algorithm)
            {
                case SignedXml.XmlDsigDSAUrl:
                    if ((this.PrivateKey as DSA) != null)
                    {
                        return (this.PrivateKey as DSA);
                    }
                    throw new NotSupportedException("Private key cannot be used with DSA");

                case SignedXml.XmlDsigRSASHA1Url:
                case EncryptedXml.XmlEncRSA15Url:
                case EncryptedXml.XmlEncRSAOAEPUrl:
                    if ((this.PrivateKey as RSA) != null)
                    {
                        return (this.PrivateKey as RSA);
                    }
                    throw new NotSupportedException("Private key cannot be used with RSA");
                default:
                    throw new NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm));
            }
        }
        else
        {
            switch (algorithm)
            {
                case SignedXml.XmlDsigDSAUrl:
                    if ((this.PublicKey.Key as DSA) != null)
                    {
                        return (this.PublicKey.Key as DSA);
                    }
                    throw new NotSupportedException("Public key cannot be used with DSA");
                case SignedXml.XmlDsigRSASHA1Url:
                case EncryptedXml.XmlEncRSA15Url:
                case EncryptedXml.XmlEncRSAOAEPUrl:
                    if ((this.PublicKey.Key as RSA) != null)
                    {
                        return (this.PublicKey.Key as RSA);
                    }
                    throw new NotSupportedException("Public key cannot be used with RSA");
                default:
                    throw new NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm));
            }
        }
    }

    public override HashAlgorithm GetHashAlgorithmForSignature(string algorithm)
    {
        if (!this.IsSupportedAlgorithm(algorithm))
        {
            throw new NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm));
        }

        switch (algorithm)
        {
            case SignedXml.XmlDsigDSAUrl:
            case SignedXml.XmlDsigRSASHA1Url:
                return new SHA1Managed();
            default:
                throw new NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm));
        }
    }

    public override AsymmetricSignatureFormatter GetSignatureFormatter(string algorithm)
    {
        // The signature can be created only if the private key is present.
        if (this.PrivateKey == null)
        {
            throw new NotSupportedException("Private key is missing");
        }

        // Only one of the two algorithms is supported, not both.
        //     XmlDsigDSAUrl = "http://www.w3.org/2000/09/xmldsig#dsa-sha1";
        //     XmlDsigRSASHA1Url = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
        switch (algorithm)
        {
            case SignedXml.XmlDsigDSAUrl:

                // Ensure that this is a DSA algorithm object.
                DSA dsa = (this.PrivateKey as DSA);
                if (dsa == null)
                {
                    throw new NotSupportedException("Private key cannot be used DSA");
                }

                return new DSASignatureFormatter(dsa);

            case SignedXml.XmlDsigRSASHA1Url:
                // Ensure that this is an RSA algorithm object.
                RSA rsa = (this.PrivateKey as RSA);
                if (rsa == null)
                {
                    throw new NotSupportedException("Private key cannot be used RSA");
                }

                return new RSAPKCS1SignatureFormatter(rsa);
            default:
                throw new NotSupportedException(String.Format("Algorithm {0} is not supported", algorithm));
        }
    }

    public override bool IsSupportedAlgorithm(string algorithm)
    {
        switch (algorithm)
        {
            case SignedXml.XmlDsigDSAUrl:
                return (this.PublicKey.Key is DSA);

            case SignedXml.XmlDsigRSASHA1Url:
            case EncryptedXml.XmlEncRSA15Url:
            case EncryptedXml.XmlEncRSAOAEPUrl:
                return (this.PublicKey.Key is RSA);

            default:
                return false;
        }
    }
}

下面的过程演示如何将上面的过程中创建的自定义 X.509 非对称安全密钥实现与 WCF 安全框架集成，以替换系统提供的 X.509 安全令牌。

将系统提供的 X.509 安全令牌替换为自定义 X.509 非对称安全密钥令牌

  1. 创建一个自定义 X.509 安全令牌，此令牌返回自定义 X.509 非对称安全密钥而不是系统提供的安全密钥，如下面的示例所示。有关自定义安全令牌的更多信息，请参见如何：创建自定义令牌。

    Friend Class CustomX509SecurityToken
    Inherits X509SecurityToken

    Private _securityKeys As ReadOnlyCollection(Of SecurityKey)

    Public Sub New(ByVal certificate As X509Certificate2)
        MyBase.New(certificate)
    End Sub

    Public Overrides ReadOnly Property SecurityKeys() As ReadOnlyCollection(Of SecurityKey)
        Get
            If Me._securityKeys Is Nothing Then
                Dim temp As New List(Of SecurityKey)(1)
                temp.Add(New CustomX509AsymmetricSecurityKey(Me.Certificate))
                Me._securityKeys = temp.AsReadOnly()
            End If
            Return Me._securityKeys
        End Get
    End Property

End Class

    class CustomX509SecurityToken : X509SecurityToken
{
    ReadOnlyCollection<SecurityKey> securityKeys;
    public CustomX509SecurityToken(X509Certificate2 certificate)
        : base(certificate)
    {
    }

    public override ReadOnlyCollection<SecurityKey> SecurityKeys
    {
        get
        {
            if (this.securityKeys == null)
            {
                List<SecurityKey> temp = new List<SecurityKey>(1);
                temp.Add(new CustomX509AsymmetricSecurityKey(this.Certificate));
                this.securityKeys = temp.AsReadOnly();
            }
            return this.securityKeys;
        }
    }
}

  2. 创建一个自定义安全令牌提供程序以返回一个自定义 X.509 安全令牌，如下面的示例所示。有关自定义安全令牌提供程序的更多信息，请参见如何：创建自定义安全令牌提供程序。

    Friend Class CustomX509SecurityTokenProvider
    Inherits SecurityTokenProvider

    Private _certificate As X509Certificate2

    Public Sub New(ByVal certificate As X509Certificate2)
        Me._certificate = certificate
    End Sub

    Protected Overrides Function GetTokenCore(ByVal timeout As TimeSpan) As SecurityToken
        Return New CustomX509SecurityToken(_certificate)
    End Function
End Class

    class CustomX509SecurityTokenProvider : SecurityTokenProvider
{
    X509Certificate2 certificate;

    public CustomX509SecurityTokenProvider(X509Certificate2 certificate)
    {
        this.certificate = certificate;
    }

    protected override SecurityToken GetTokenCore(TimeSpan timeout)
    {
        return new CustomX509SecurityToken(certificate);
    }
}

  3. 如果自定义安全密钥需要在发起方端使用，请创建一个自定义客户端安全令牌管理器和若干自定义客户端凭据类，如下面的示例所示。有关自定义客户端凭据和客户端安全令牌管理器的更多信息，请参见演练：创建自定义客户端和服务凭据。

    Friend Class CustomClientSecurityTokenManager
    Inherits ClientCredentialsSecurityTokenManager

    Private credentials As CustomClientCredentials

    Public Sub New(ByVal credentials As CustomClientCredentials)
        MyBase.New(credentials)
        Me.credentials = credentials
    End Sub

    Public Overrides Function CreateSecurityTokenProvider(ByVal tokenRequirement As SecurityTokenRequirement) _
    As SecurityTokenProvider
        Dim result As SecurityTokenProvider = Nothing

        If tokenRequirement.TokenType = SecurityTokenTypes.X509Certificate Then
            Dim direction = tokenRequirement.GetProperty(Of MessageDirection) _
            (ServiceModelSecurityTokenRequirement.MessageDirectionProperty)
            If direction = MessageDirection.Output Then
                If tokenRequirement.KeyUsage = SecurityKeyUsage.Signature Then
                    result = New CustomX509SecurityTokenProvider(credentials.ClientCertificate.Certificate)
                End If
            Else
                If tokenRequirement.KeyUsage = SecurityKeyUsage.Exchange Then
                    result = New CustomX509SecurityTokenProvider(credentials.ClientCertificate.Certificate)
                End If
            End If
        End If

        If result Is Nothing Then
            result = MyBase.CreateSecurityTokenProvider(tokenRequirement)
        End If
        Return result
    End Function
End Class

    class CustomClientSecurityTokenManager : ClientCredentialsSecurityTokenManager
{
    CustomClientCredentials credentials;

    public CustomClientSecurityTokenManager(CustomClientCredentials credentials)
        : base(credentials)
    {
        this.credentials = credentials;
    }

    public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
    {
        SecurityTokenProvider result = null;

        if (tokenRequirement.TokenType == SecurityTokenTypes.X509Certificate)
        {
            MessageDirection direction = tokenRequirement.GetProperty<MessageDirection>(ServiceModelSecurityTokenRequirement.MessageDirectionProperty);
            if (direction == MessageDirection.Output)
            {
                if (tokenRequirement.KeyUsage == SecurityKeyUsage.Signature)
                {
                    result = new CustomX509SecurityTokenProvider(credentials.ClientCertificate.Certificate);
                }
            }
            else
            {
                if (tokenRequirement.KeyUsage == SecurityKeyUsage.Exchange)
                {
                    result = new CustomX509SecurityTokenProvider(credentials.ClientCertificate.Certificate);
                }
            }
        }

        if (result == null)
        {
            result = base.CreateSecurityTokenProvider(tokenRequirement);
        }
        return result;
    }
}

    Public Class CustomClientCredentials
    Inherits ClientCredentials

    Public Sub New()
    End Sub

    Protected Sub New(ByVal other As CustomClientCredentials)
        MyBase.New(other)
    End Sub

    Protected Overrides Function CloneCore() As ClientCredentials
        Return New CustomClientCredentials(Me)
    End Function

    Public Overrides Function CreateSecurityTokenManager() As SecurityTokenManager
        Return New CustomClientSecurityTokenManager(Me)
    End Function
End Class

    public class CustomClientCredentials : ClientCredentials
{
    public CustomClientCredentials()
    {
    }

    protected CustomClientCredentials(CustomClientCredentials other)
        : base(other)
    {
    }

    protected override ClientCredentials CloneCore()
    {
        return new CustomClientCredentials(this);
    }

    public override SecurityTokenManager CreateSecurityTokenManager()
    {
        return new CustomClientSecurityTokenManager(this);
    }
}

  4. 如果自定义安全密钥需要在接收方端使用，请创建一个自定义服务安全令牌管理器和若干自定义服务凭据，如下面的示例所示。有关自定义服务凭据和服务安全令牌管理器的更多信息，请参见演练：创建自定义客户端和服务凭据。

    Friend Class CustomServiceSecurityTokenManager
    Inherits ServiceCredentialsSecurityTokenManager

    Private credentials As CustomServiceCredentials

    Public Sub New(ByVal credentials As CustomServiceCredentials)
        MyBase.New(credentials)
        Me.credentials = credentials
    End Sub

    Public Overrides Function CreateSecurityTokenProvider(ByVal tokenRequirement As SecurityTokenRequirement) As SecurityTokenProvider
        Dim result As SecurityTokenProvider = Nothing

        If tokenRequirement.TokenType = SecurityTokenTypes.X509Certificate Then
            Dim direction = tokenRequirement.GetProperty(Of MessageDirection) _
            (ServiceModelSecurityTokenRequirement.MessageDirectionProperty)
            If direction = MessageDirection.Input Then
                If tokenRequirement.KeyUsage = SecurityKeyUsage.Exchange Then
                    result = New CustomX509SecurityTokenProvider(credentials.ServiceCertificate.Certificate)
                End If
            Else
                If tokenRequirement.KeyUsage = SecurityKeyUsage.Signature Then
                    result = New CustomX509SecurityTokenProvider(credentials.ServiceCertificate.Certificate)
                End If
            End If
        End If

        If result Is Nothing Then
            result = MyBase.CreateSecurityTokenProvider(tokenRequirement)
        End If
        Return result
    End Function
End Class

    class CustomServiceSecurityTokenManager : ServiceCredentialsSecurityTokenManager
{
    CustomServiceCredentials credentials;

    public CustomServiceSecurityTokenManager(CustomServiceCredentials credentials)
        : base(credentials)
    {
        this.credentials = credentials;
    }

    public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
    {
        SecurityTokenProvider result = null;

        if (tokenRequirement.TokenType == SecurityTokenTypes.X509Certificate)
        {
            MessageDirection direction = tokenRequirement.GetProperty<MessageDirection>(ServiceModelSecurityTokenRequirement.MessageDirectionProperty);
            if (direction == MessageDirection.Input)
            {
                if (tokenRequirement.KeyUsage == SecurityKeyUsage.Exchange)
                {
                    result = new CustomX509SecurityTokenProvider(credentials.ServiceCertificate.Certificate);
                }
            }
            else
            {
                if (tokenRequirement.KeyUsage == SecurityKeyUsage.Signature)
                {
                    result = new CustomX509SecurityTokenProvider(credentials.ServiceCertificate.Certificate);
                }
            }
        }

        if (result == null)
        {
            result = base.CreateSecurityTokenProvider(tokenRequirement);
        }
        return result;
    }
}

    Public Class CustomServiceCredentials
    Inherits ServiceCredentials

    Public Sub New()
    End Sub

    Protected Sub New(ByVal other As CustomServiceCredentials)
        MyBase.New(other)
    End Sub

    Protected Overrides Function CloneCore() As ServiceCredentials
        Return New CustomServiceCredentials(Me)
    End Function

    Public Overrides Function CreateSecurityTokenManager() As SecurityTokenManager
        Return New CustomServiceSecurityTokenManager(Me)
    End Function

End Class

    public class CustomServiceCredentials : ServiceCredentials
{
    public CustomServiceCredentials()
    {
    }

    protected CustomServiceCredentials(CustomServiceCredentials other)
        : base(other)
    {
    }

    protected override ServiceCredentials CloneCore()
    {
        return new CustomServiceCredentials(this);
    }

    public override SecurityTokenManager CreateSecurityTokenManager()
    {
        return new CustomServiceSecurityTokenManager(this);
    }
}

另请参见

任务

如何：创建自定义安全令牌提供程序

参考

X509AsymmetricSecurityKey
AsymmetricSecurityKey
SecurityKey
AsymmetricAlgorithm
HashAlgorithm
AsymmetricSignatureFormatter

概念

演练：创建自定义客户端和服务凭据
如何：创建自定义安全令牌身份验证器
如何：创建自定义令牌
安全体系结构