用於Web服務

Question

我如何授權客戶端（在這種情況下，客戶端是一個應用程序）中使用.NET Web服務，

例如客戶端授權一種方法，但不允許網絡內的其他應用程序調用此方法。

我想避免傳輸層授權並使用基於消息的授權。

Answer 1

您應該看看WS-Security和WS-Policy標準。最好的方法是讓客戶端應用程序（使用私鑰）簽署所有請求，並在服務器端檢查此簽名。

我們使用安裝這樣，與WSDL以下WS-Policy定義：

<!--Endpoint Policy--> 
<wsp:Policy wsu:Id="Endpoint_policy" 
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <wsp:ExactlyOne> 
    <wsp:All> 

     <sp:AsymmetricBinding 
     xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <wsp:Policy> 
      <sp:InitiatorToken> 
      <wsp:Policy> 
       <sp:X509Token 
       sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/AlwaysToRecipient"> 
       <wsp:Policy> 
        <sp:WssX509V3Token10 /> 
       </wsp:Policy> 
       </sp:X509Token> 
      </wsp:Policy> 
      </sp:InitiatorToken> 

      <sp:RecipientToken> 
      <wsp:Policy> 
       <sp:X509Token 
       sp:IncludeToken="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy/IncludeToken/Never"> 
       <wsp:Policy> 
        <sp:WssX509V3Token10 /> 
       </wsp:Policy> 
       </sp:X509Token> 
      </wsp:Policy> 
      </sp:RecipientToken> 

      <sp:AlgorithmSuite> 
      <wsp:Policy> 
       <!-- sp:Basic256/--> 
       <sp:TripleDesRsa15 /> 
      </wsp:Policy> 
      </sp:AlgorithmSuite> 

      <sp:Layout> 
      <wsp:Policy> 
       <sp:Lax /> 
      </wsp:Policy> 
      </sp:Layout> 

     </wsp:Policy> 
     </sp:AsymmetricBinding> 

     <sp:Wss10 
     xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <wsp:Policy> 
      <sp:MustSupportRefKeyIdentifier /> 
      <sp:MustSupportRefIssuerSerial /> 
     </wsp:Policy> 
     </sp:Wss10> 

    </wsp:All> 
    </wsp:ExactlyOne> 
</wsp:Policy> 
<!--End of Endpoint Policy--> 

<!--Message Policy1--> 
<wsp:Policy wsu:Id="Sign_message_policy" 
      xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"> 
    <wsp:ExactlyOne> 
    <wsp:All> 

     <sp:SignedParts 
     xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy"> 
     <sp:Body /> 
     </sp:SignedParts> 

    </wsp:All> 
    </wsp:ExactlyOne> 
</wsp:Policy> 

<!--End of Message Policy1--> 

然後，您在WSDL的結合部分引用這些政策。例如：

<binding name="ExampleServiceSOAP" type="foobar:ExampleServicePort"> 
    <!-- WS-Security --> 
    <wsp:PolicyReference URI="#Endpoint_policy" /> 
    <soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/> 
    <operation name="getSomething"> 
     <soap:operation soapAction="getSomething" style="document"/> 
     <input> 
     <!-- WS-Security --> 
     <wsp:PolicyReference URI="#Sign_message_policy" /> 
     <soap:body use="literal"/> 
     </input> 
     <output> 
     <soap:body use="literal"/> 
     </output> 
    </operation> 
    </binding> 

Answer 2

最簡單的（也是最「便攜」的）就是使用HTTP Authentication。