用于Web服务

Question

我如何授权客户端（在这种情况下，客户端是一个应用程序）中使用.NET Web服务，

例如客户端授权一种方法，但不允许网络内的其他应用程序调用此方法。

我想避免传输层授权并使用基于消息的授权。

Answer 1

您应该看看WS-Security和WS-Policy标准。最好的方法是让客户端应用程序（使用私钥）签署所有请求，并在服务器端检查此签名。

我们使用安装这样，与WSDL以下WS-Policy定义：

<!--Endpoint Policy--> 
<wsp:Policy wsu:Id="Endpoint_policy" 
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <wsp:ExactlyOne> 
    <wsp:All> 

     <sp:AsymmetricBinding 
     xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <wsp:Policy> 
      <sp:InitiatorToken> 
      <wsp:Policy> 
       <sp:X509Token 
       sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"> 
       <wsp:Policy> 
        <sp:WssX509V3Token10 /> 
       </wsp:Policy> 
       </sp:X509Token> 
      </wsp:Policy> 
      </sp:InitiatorToken> 

      <sp:RecipientToken> 
      <wsp:Policy> 
       <sp:X509Token 
       sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never"> 
       <wsp:Policy> 
        <sp:WssX509V3Token10 /> 
       </wsp:Policy> 
       </sp:X509Token> 
      </wsp:Policy> 
      </sp:RecipientToken> 

      <sp:AlgorithmSuite> 
      <wsp:Policy> 
       <!-- sp:Basic256/--> 
       <sp:TripleDesRsa15 /> 
      </wsp:Policy> 
      </sp:AlgorithmSuite> 

      <sp:Layout> 
      <wsp:Policy> 
       <sp:Lax /> 
      </wsp:Policy> 
      </sp:Layout> 

     </wsp:Policy> 
     </sp:AsymmetricBinding> 

     <sp:Wss10 
     xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <wsp:Policy> 
      <sp:MustSupportRefKeyIdentifier /> 
      <sp:MustSupportRefIssuerSerial /> 
     </wsp:Policy> 
     </sp:Wss10> 

    </wsp:All> 
    </wsp:ExactlyOne> 
</wsp:Policy> 
<!--End of Endpoint Policy--> 

<!--Message Policy1--> 
<wsp:Policy wsu:Id="Sign_message_policy" 
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <wsp:ExactlyOne> 
    <wsp:All> 

     <sp:SignedParts 
     xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <sp:Body /> 
     </sp:SignedParts> 

    </wsp:All> 
    </wsp:ExactlyOne> 
</wsp:Policy> 

<!--End of Message Policy1--> 

然后，您在WSDL的结合部分引用这些政策。例如：

<binding name="ExampleServiceSOAP" type="foobar:ExampleServicePort"> 
    <!-- WS-Security --> 
    <wsp:PolicyReference URI="#Endpoint_policy" /> 
    <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/> 
    <operation name="getSomething"> 
     <soap:operation soapAction="getSomething" style="document"/> 
     <input> 
     <!-- WS-Security --> 
     <wsp:PolicyReference URI="#Sign_message_policy" /> 
     <soap:body use="literal"/> 
     </input> 
     <output> 
     <soap:body use="literal"/> 
     </output> 
    </operation> 
    </binding> 

Answer 2

最简单的（也是最“便携”的）就是使用HTTP Authentication。