如何：创建自定义客户端标识验证工具

项目
02/28/2011

Windows Communication Foundation (WCF) 的标识**功能使客户端能够预先指定服务所需的标识。无论服务器何时向客户端验证其自身身份，都将检查该标识是否为所需的标识。（有关标识的解释及其工作原理，请参见服务标识和身份验证。）

如果需要，可使用自定义标识验证工具自定义该验证。例如，您可以执行其他服务标识验证检查。在本示例中，自定义标识验证工具将检查从服务器返回的 X.509 证书中的其他声明。有关示例应用程序，请参见服务标识示例。

扩展 EndpointIdentity 类

定义一个从 EndpointIdentity 类派生的新类。本示例将此扩展命名为 OrgEndpointIdentity。

添加私有成员和属性，扩展的 IdentityVerifier 类将使用这些属性根据从服务返回的安全令牌中的声明执行标识检查。本示例定义一个属性：OrganizationClaim 属性。

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

扩展 IdentityVerifier 类

定义一个从 IdentityVerifier 派生的新类。本示例将此扩展命名为 CustomIdentityVerifier。

Public Class CustomIdentityVerifier
    Inherits IdentityVerifier
    ' Code to be added.

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function
End Class

public class CustomIdentityVerifier : IdentityVerifier
{
    // Code to be added.
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        throw new Exception("The method or operation is not implemented.");
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        throw new Exception("The method or operation is not implemented.");
    }
}

重写 CheckAccess 方法。该方法确定标识检查是成功还是失败。

CheckAccess 方法有两个参数。第一个参数是 EndpointIdentity 类的一个实例。第二个参数是 AuthorizationContext 类的一个实例。

在方法的实现过程中，检查 AuthorizationContext 类的 ClaimSets 属性返回的声明集合，并根据需要执行身份验证检查。本示例首先查找类型为“可分辨名称”的任何声明，然后将此名称与 EndpointIdentity 扩展的名称 (OrgEndpointIdentity) 进行比较。

Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                      ByVal authContext As AuthorizationContext) As Boolean

    Dim returnvalue = False
    For Each claimset In authContext.ClaimSets
        For Each claim In claimset
            If claim.ClaimType = "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                Dim name = CType(claim.Resource, X500DistinguishedName)
                If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                    Console.WriteLine("Right: {0}", claim.Right)
                    Console.WriteLine("Resource: {0}", claim.Resource)
                    Console.WriteLine()
                    returnvalue = True
                End If
            End If
        Next claim
    Next claimset
    Return returnvalue

End Function

public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
{
    bool returnvalue = false;

    foreach (ClaimSet claimset in authContext.ClaimSets)
    {
        foreach (Claim claim in claimset)
        {
            if (claim.ClaimType == "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
            {
                X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                {
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                    Console.WriteLine("Right: {0}", claim.Right);
                    Console.WriteLine("Resource: {0}", claim.Resource);
                    Console.WriteLine();
                    returnvalue = true;
                }
            }
        }

    }
    return returnvalue;
}

实现 TryGetIdentity 方法

实现 TryGetIdentity 方法，该方法确定客户端是否可返回 EndpointIdentity 类的实例。WCF 基础结构首先调用 TryGetIdentity 方法的实现来检索消息中的服务标识。然后，该基础结构使用返回的 EndpointIdentity 和 AuthorizationContext 调用 CheckAccess 实现。

在 TryGetIdentity 方法中，添加以下代码：

Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                         <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
    Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
End Function

public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
{
    return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
}

实现自定义绑定并设置自定义标识验证工具

创建一个返回 Binding 对象的方法。本示例首先创建 WSHttpBinding 类的一个实例，然后将其安全模式设置为 Message，并且将其 ClientCredentialType 设置为 None。
使用 CreateBindingElements 方法创建一个 BindingElementCollection。
从集合返回 SecurityBindingElement，并将其强制转换为一个 SymmetricSecurityBindingElement 变量。

将 LocalClientSecuritySettings 类的 IdentityVerifier 属性设置为先前创建的 CustomIdentityVerifier 类的一个新实例。

Public Shared Function CreateCustomSecurityBinding() As Binding
    Dim binding As New WSHttpBinding(SecurityMode.Message)

    With binding.Security.Message
        'Clients are anonymous to the service.
        .ClientCredentialType = MessageCredentialType.None
        'Secure conversation is turned off for simplification. If secure conversation is turned on, then 
        'you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
        .EstablishSecurityContext = False
    End With
    ' Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    Dim outputBec = binding.CreateBindingElements()
    Dim ssbe = CType(outputBec.Find(Of SecurityBindingElement)(), SymmetricSecurityBindingElement)

    'Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = New CustomIdentityVerifier()

    Return New CustomBinding(outputBec)
End Function

public static Binding CreateCustomSecurityBinding()
{
    WSHttpBinding binding = new WSHttpBinding(SecurityMode.Message);
    //Clients are anonymous to the service.
    binding.Security.Message.ClientCredentialType = MessageCredentialType.None;
    //Secure conversation is turned off for simplification. If secure conversation is turned on, then 
    //you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
    binding.Security.Message.EstablishSecurityContext = false;

    // Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    BindingElementCollection outputBec = binding.CreateBindingElements();
    SymmetricSecurityBindingElement ssbe = (SymmetricSecurityBindingElement)outputBec.Find<SecurityBindingElement>();

    //Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = new CustomIdentityVerifier();

    return new CustomBinding(outputBec);
}

使用返回的自定义绑定创建客户端和类的一个实例。然后，客户端可执行服务的自定义标识验证检查，如以下代码中所示。

Using client As New CalculatorClient(customSecurityBinding, serviceAddress)

using (CalculatorClient client = new CalculatorClient(customSecurityBinding, serviceAddress))
{

示例

下面的示例演示 IdentityVerifier 类的完整实现。

Friend Class CustomIdentityVerifier
    Inherits IdentityVerifier

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean

        Dim returnvalue = False
        For Each claimset In authContext.ClaimSets
            For Each claim In claimset
                If claim.ClaimType = "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                    Dim name = CType(claim.Resource, X500DistinguishedName)
                    If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                        Console.WriteLine("Right: {0}", claim.Right)
                        Console.WriteLine("Resource: {0}", claim.Resource)
                        Console.WriteLine()
                        returnvalue = True
                    End If
                End If
            Next claim
        Next claimset
        Return returnvalue

    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
    End Function

End Class

class CustomIdentityVerifier : IdentityVerifier
{
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        bool returnvalue = false;

        foreach (ClaimSet claimset in authContext.ClaimSets)
        {
            foreach (Claim claim in claimset)
            {
                if (claim.ClaimType == "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
                {
                    X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                    if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                    {
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                        Console.WriteLine("Right: {0}", claim.Right);
                        Console.WriteLine("Resource: {0}", claim.Resource);
                        Console.WriteLine();
                        returnvalue = true;
                    }
                }
            }

        }
        return returnvalue;
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
    }
}

下面的示例演示 EndpointIdentity 类的完整实现。

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

通过

如何：创建自定义客户端标识验证工具

扩展 EndpointIdentity 类

扩展 IdentityVerifier 类

实现 TryGetIdentity 方法

实现自定义绑定并设置自定义标识验证工具

示例

另请参见

任务

参考

其他资源