作法：建立自訂用戶端身分識別驗證器

發行項
05/22/2023

Windows Communication Foundation (WCF) 的「身分識別」功能可讓用戶端預先指定服務的預期身分識別。每當伺服器向用戶端驗證自身時，就會比對預期身分識別來檢查身分識別 (如需身分識別及其運作方式的說明，請參閱服務識別和驗證 (機器翻譯)。)

必要時，可使用自訂身分識別驗證器來自訂驗證。例如，您可以執行其他服務身分識別驗證檢查。在這個範例中，自訂身分識別驗證器會檢查從伺服器所傳回的 X.509 憑證中的其他宣告。如需應用程式範例，請參閱服務識別範例 (機器翻譯)。

若要擴充 EndpointIdentity 類別

定義衍生自 EndpointIdentity 類別的新類別。這個範例會將擴充功能命名為 OrgEndpointIdentity。

加入私用成員與擴充 IdentityVerifier 類別將會使用的屬性，對服務所傳回安全性權杖中的宣告執行身分識別檢查。這個範例會定義一個屬性：OrganizationClaim 屬性。

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

若要擴充 IdentityVerifier 類別

定義衍生自 IdentityVerifier 的新類別。這個範例會將擴充功能命名為 CustomIdentityVerifier。

public class CustomIdentityVerifier : IdentityVerifier
{
    // Code to be added.
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        throw new Exception("The method or operation is not implemented.");
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        throw new Exception("The method or operation is not implemented.");
    }
}

Public Class CustomIdentityVerifier
    Inherits IdentityVerifier
    ' Code to be added.

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function
End Class

覆寫 CheckAccess 方法。這個方法會判斷身分識別檢查是成功還是失敗。

CheckAccess 方法有兩個參數。第一個是 EndpointIdentity 類別的執行個體。第二個是 AuthorizationContext 類別的執行個體。

在方法實作中，檢查 ClaimSets 類別的 AuthorizationContext 屬性傳回的宣告集合，並執行必要的驗證檢查。這個範例會先尋找 "Distinguished Name" 型別的任何宣告，然後比較名稱與 EndpointIdentity 的擴充功能 (OrgEndpointIdentity)。

public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
{
    bool returnvalue = false;

    foreach (ClaimSet claimset in authContext.ClaimSets)
    {
        foreach (Claim claim in claimset)
        {
            if (claim.ClaimType == "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
            {
                X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                {
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                    Console.WriteLine("Right: {0}", claim.Right);
                    Console.WriteLine("Resource: {0}", claim.Resource);
                    Console.WriteLine();
                    returnvalue = true;
                }
            }
        }
    }
    return returnvalue;
}


Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                      ByVal authContext As AuthorizationContext) As Boolean

    Dim returnvalue = False
    For Each claimset In authContext.ClaimSets
        For Each claim In claimset
            If claim.ClaimType = "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                Dim name = CType(claim.Resource, X500DistinguishedName)
                If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                    Console.WriteLine("Right: {0}", claim.Right)
                    Console.WriteLine("Resource: {0}", claim.Resource)
                    Console.WriteLine()
                    returnvalue = True
                End If
            End If
        Next claim
    Next claimset
    Return returnvalue

End Function

若要實作 TryGetIdentity 方法

實作 TryGetIdentity 方法，可判斷 EndpointIdentity 類別的執行個體是否可由用戶端傳回。 WCF 基礎結構會先呼叫實作 TryGetIdentity 方法，從訊息擷取服務的識別。接著，基礎結構會使用所傳回的 CheckAccess 和 EndpointIdentity 來呼叫 AuthorizationContext 實作。

在 TryGetIdentity 方法中，放入下列程式碼：

public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
{
    return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
}

Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                         <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
    Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
End Function

若要實作自訂繫結及設定自訂 IdentityVerifier

建立會傳回 Binding 物件的方法。這個範例會先建立 WSHttpBinding 類別的執行個體，並將其安全性模式設定為 Message 及其 ClientCredentialType 設定為 None。
使用 BindingElementCollection 方法來建立 CreateBindingElements。
從集合中傳回 SecurityBindingElement 並將其轉換為 SymmetricSecurityBindingElement 變數。

將 IdentityVerifier 類別的 LocalClientSecuritySettings 屬性設定為先前新建立的 CustomIdentityVerifier 類別執行個體。

public static Binding CreateCustomSecurityBinding()
{
    WSHttpBinding binding = new WSHttpBinding(SecurityMode.Message);
    //Clients are anonymous to the service.
    binding.Security.Message.ClientCredentialType = MessageCredentialType.None;
    //Secure conversation is turned off for simplification. If secure conversation is turned on, then
    //you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
    binding.Security.Message.EstablishSecurityContext = false;

    // Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    BindingElementCollection outputBec = binding.CreateBindingElements();
    SymmetricSecurityBindingElement ssbe = (SymmetricSecurityBindingElement)outputBec.Find<SecurityBindingElement>();

    //Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = new CustomIdentityVerifier();

    return new CustomBinding(outputBec);
}

Public Shared Function CreateCustomSecurityBinding() As Binding
    Dim binding As New WSHttpBinding(SecurityMode.Message)

    With binding.Security.Message
        'Clients are anonymous to the service.
        .ClientCredentialType = MessageCredentialType.None
        'Secure conversation is turned off for simplification. If secure conversation is turned on, then 
        'you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
        .EstablishSecurityContext = False
    End With
    ' Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    Dim outputBec = binding.CreateBindingElements()
    Dim ssbe = CType(outputBec.Find(Of SecurityBindingElement)(), SymmetricSecurityBindingElement)

    'Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = New CustomIdentityVerifier()

    Return New CustomBinding(outputBec)
End Function

所傳回的自訂繫結會用來建立用戶端和類別的執行個體。然後，用戶端就可以對服務執行自訂身分識別驗證檢查，如下列程式碼所示。
```
using (CalculatorClient client = new CalculatorClient(customSecurityBinding, serviceAddress))
{
```
```
Using client As New CalculatorClient(customSecurityBinding, serviceAddress)
```

範例 1

下列範例會示範 IdentityVerifier 類別的完整實作。

class CustomIdentityVerifier : IdentityVerifier
{
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        bool returnvalue = false;

        foreach (ClaimSet claimset in authContext.ClaimSets)
        {
            foreach (Claim claim in claimset)
            {
                if (claim.ClaimType == "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
                {
                    X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                    if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                    {
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                        Console.WriteLine("Right: {0}", claim.Right);
                        Console.WriteLine("Resource: {0}", claim.Resource);
                        Console.WriteLine();
                        returnvalue = true;
                    }
                }
            }
        }
        return returnvalue;
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
    }
}

Friend Class CustomIdentityVerifier
    Inherits IdentityVerifier

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean

        Dim returnvalue = False
        For Each claimset In authContext.ClaimSets
            For Each claim In claimset
                If claim.ClaimType = "http://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                    Dim name = CType(claim.Resource, X500DistinguishedName)
                    If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                        Console.WriteLine("Right: {0}", claim.Right)
                        Console.WriteLine("Resource: {0}", claim.Resource)
                        Console.WriteLine()
                        returnvalue = True
                    End If
                End If
            Next claim
        Next claimset
        Return returnvalue

    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
    End Function

End Class

範例 2

下列範例會示範 EndpointIdentity 類別的完整實作。

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class