如何:创建自定义安全令牌身份验证器

本主题演示如何创建自定义安全令牌身份验证器以及如何将其与自定义安全令牌管理器相集成。安全令牌身份验证器可验证随传入消息一起提供的安全令牌的内容。如果验证成功,身份验证器将返回 IAuthorizationPolicy 实例的集合,该集合经过计算后可返回一组声明。

若要在 Windows Communication Foundation (WCF) 中使用自定义安全令牌身份验证器,必须首先创建自定义凭据和安全令牌管理器实现。有关创建自定义凭据和安全令牌管理器的更多信息,请参见演练:创建自定义客户端和服务凭据。有关凭据、安全令牌管理器、提供程序和身份验证器类的更多信息,请参见安全体系结构

过程

创建自定义安全令牌身份验证器

  1. 定义一个从 SecurityTokenAuthenticator 类派生的新类。

  2. 重写 CanValidateTokenCore 方法。此方法返回 truefalse,具体取决于自定义身份验证器是否可以验证传入的令牌类型。

  3. 重写 ValidateTokenCore 方法。此方法需要适当地验证令牌内容。如果此令牌通过验证步骤,它将返回 IAuthorizationPolicy 实例的集合。下面的示例使用将在后面的过程中创建的自定义授权策略实现。

    Friend Class MySecurityTokenAuthenticator
        Inherits SecurityTokenAuthenticator
    
        Protected Overrides Function CanValidateTokenCore(ByVal token As SecurityToken) As Boolean
            ' Check that the incoming token is a username token type that  
            ' can be validated by this implementation.
            Return (TypeOf token Is UserNameSecurityToken)
        End Function
    
        Protected Overrides Function ValidateTokenCore(ByVal token As SecurityToken) As ReadOnlyCollection(Of IAuthorizationPolicy)
    
            Dim userNameToken = TryCast(token, UserNameSecurityToken)
    
            ' Validate the information contained in the username token. For demonstration 
            ' purposes, this code just checks that the user name matches the password.
            If userNameToken.UserName <> userNameToken.Password Then
                Throw New SecurityTokenValidationException("Invalid user name or password")
            End If
    
            ' Create just one Claim instance for the username token - the name of the user.
            Dim userNameClaimSet As New DefaultClaimSet(ClaimSet.System, _
                                                        New Claim(ClaimTypes.Name, _
                                                        userNameToken.UserName, _
                                                        Rights.PossessProperty))
            Dim policies As New List(Of IAuthorizationPolicy)(1)
            policies.Add(New MyAuthorizationPolicy(userNameClaimSet))
            Return policies.AsReadOnly()
        End Function
    
    End Class
    
    internal class MySecurityTokenAuthenticator : SecurityTokenAuthenticator
    {
        protected override bool CanValidateTokenCore(SecurityToken token)
        {
            // Check that the incoming token is a username token type that  
            // can be validated by this implementation.
            return (token is UserNameSecurityToken);
        }
    
        protected override ReadOnlyCollection<IAuthorizationPolicy> 
            ValidateTokenCore(SecurityToken token)
        {
            UserNameSecurityToken userNameToken = token as UserNameSecurityToken;
    
            // Validate the information contained in the username token. For demonstration 
            // purposes, this code just checks that the user name matches the password.
            if (userNameToken.UserName != userNameToken.Password)
            {
                throw new SecurityTokenValidationException("Invalid user name or password");
            }
    
            // Create just one Claim instance for the username token - the name of the user.
            DefaultClaimSet userNameClaimSet = new DefaultClaimSet(
                ClaimSet.System, 
                new Claim(ClaimTypes.Name, userNameToken.UserName, Rights.PossessProperty));
            List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>(1);
            policies.Add(new MyAuthorizationPolicy(userNameClaimSet));
            return policies.AsReadOnly();
        }
    }
    

上面的代码返回 CanValidateToken 方法中授权策略的集合。WCF 并不提供此接口的公共实现。下面的过程演示如何针对您自己的要求实现此目的。

创建自定义授权策略

  1. 定义一个实现 IAuthorizationPolicy 接口的新类。

  2. 实现 Id 只读属性。实现此属性的一个方法是在类构造函数中生成一个全局唯一标识符 (GUID),并在每次请求此属性的值时返回该标识符。

  3. 实现 Issuer 只读属性。此属性需要返回从令牌获取的声明集的颁发者。此颁发者应该与令牌颁发者负责验证令牌内容的颁发机构相对应。下面的示例使用了颁发者声明,该声明从前面的过程中创建的自定义安全令牌身份验证器传递给此类。自定义安全令牌身份验证器使用系统提供的声明集(由 System 属性返回)来表示用户名令牌的颁发者。

  4. 实现 Evaluate 方法。此方法使用基于传入安全令牌内容的声明来填充 EvaluationContext 类的实例(以参数形式传入)。当此方法完成计算时返回 true。如果该实现依赖于为计算上下文提供附加信息的其他授权策略,则在计算上下文中不存在所要求的信息时,此方法可返回 false。在这种情况下,如果这些授权策略之中至少有一个修改了计算上下文,WCF 在计算为传入消息生成的所有其他授权策略后,将再次调用此方法。

    Friend Class MyServiceCredentialsSecurityTokenManager
        Inherits ServiceCredentialsSecurityTokenManager
    
        Private credentials As ServiceCredentials
    
        Public Sub New(ByVal credentials As ServiceCredentials)
            MyBase.New(credentials)
            Me.credentials = credentials
        End Sub
    
        Public Overrides Function CreateSecurityTokenAuthenticator(ByVal tokenRequirement As SecurityTokenRequirement, _
                                                                   <System.Runtime.InteropServices.Out()> _
                                                                   ByRef outOfBandTokenResolver _
                                                                   As SecurityTokenResolver) As SecurityTokenAuthenticator
            ' Return your implementation of the SecurityTokenProvider based on the 
            ' tokenRequirement argument.
            Dim result As SecurityTokenAuthenticator
            If tokenRequirement.TokenType = SecurityTokenTypes.UserName Then
                Dim direction = tokenRequirement.GetProperty(Of MessageDirection)(ServiceModelSecurityTokenRequirement.MessageDirectionProperty)
                If direction = MessageDirection.Input Then
                    outOfBandTokenResolver = Nothing
                    result = New MySecurityTokenAuthenticator()
                Else
                    result = MyBase.CreateSecurityTokenAuthenticator(tokenRequirement, _
                                                                     outOfBandTokenResolver)
                End If
            Else
                result = MyBase.CreateSecurityTokenAuthenticator(tokenRequirement, _
                                                                 outOfBandTokenResolver)
            End If
    
            Return result
        End Function
    
    End Class
    
    internal class MyServiceCredentialsSecurityTokenManager : 
        ServiceCredentialsSecurityTokenManager
    {
        ServiceCredentials credentials;
        public MyServiceCredentialsSecurityTokenManager(ServiceCredentials credentials)
            : base(credentials)
        {
            this.credentials = credentials;
        }
    
        public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator
            (SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
        {
            // Return your implementation of the SecurityTokenProvider based on the 
            // tokenRequirement argument.
            SecurityTokenAuthenticator result;
            if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
            {
                MessageDirection direction = tokenRequirement.GetProperty<MessageDirection>
                    (ServiceModelSecurityTokenRequirement.MessageDirectionProperty);
                if (direction == MessageDirection.Input)
                {
                    outOfBandTokenResolver = null;
                    result = new MySecurityTokenAuthenticator();
                }
                else
                {
                    result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
                }
            }
            else
            {
                result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
            }
    
            return result;
        }
    }
    

演练:创建自定义客户端和服务凭据 说明如何创建自定义凭据和自定义安全令牌管理器。若要使用此处创建的自定义安全令牌身份验证器,可以修改安全令牌管理器的实现,以便从 CreateSecurityTokenAuthenticator 方法返回自定义身份验证器。当传入适当的安全令牌要求时,该方法将返回身份验证器。

使自定义安全令牌身份验证器与自定义安全令牌管理器相集成

  1. 在自定义安全令牌管理器实现中重写 CreateSecurityTokenAuthenticator 方法。

  2. 向该方法添加逻辑,使其能够基于 SecurityTokenRequirement 参数返回您的自定义安全令牌身份验证器。如果令牌要求的令牌类型为用户名(由 UserName 属性表示),并且正在为其请求安全令牌身份验证器的消息方向为输入(由 Input 字段表示),则下面的示例将返回自定义安全令牌身份验证器。

    Friend Class MyAuthorizationPolicy
        Implements IAuthorizationPolicy
    
        Private _id As String
        Private _tokenClaims As ClaimSet
        Private _issuer As ClaimSet
    
        Public Sub New(ByVal tokenClaims As ClaimSet)
            If _tokenClaims Is Nothing Then
                Throw New ArgumentNullException("tokenClaims")
            End If
            Me._issuer = tokenClaims.Issuer
            Me._tokenClaims = tokenClaims
            Me._id = Guid.NewGuid().ToString()
        End Sub
    
        Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer
            Get
                Return _issuer
            End Get
        End Property
    
        Public ReadOnly Property Id() As String Implements System.IdentityModel.Policy.IAuthorizationComponent.Id
            Get
                Return _id
            End Get
        End Property
    
        Public Function Evaluate(ByVal evaluationContext As EvaluationContext, _
                                 ByRef state As Object) As Boolean Implements IAuthorizationPolicy.Evaluate
    
            ' Add the token claim set to the evaluation context.
            evaluationContext.AddClaimSet(Me, _tokenClaims)
            ' Return true if the policy evaluation is finished.
            Return True
        End Function
    
    End Class
    
    internal class MyAuthorizationPolicy : IAuthorizationPolicy
    {
        string id;
        ClaimSet tokenClaims;
        ClaimSet issuer;
    
        public MyAuthorizationPolicy(ClaimSet tokenClaims)
        {
            if (tokenClaims == null)
            {
                throw new ArgumentNullException("tokenClaims");
            }
            this.issuer = tokenClaims.Issuer;
            this.tokenClaims = tokenClaims;
            this.id = Guid.NewGuid().ToString();
        }
    
        public ClaimSet Issuer
        {
            get { return issuer; }
        }
    
        public string Id
        {
            get { return id; }
        }
    
        public bool Evaluate(EvaluationContext evaluationContext, ref object state)
        {
            // Add the token claim set to the evaluation context.
            evaluationContext.AddClaimSet(this, tokenClaims);
    
            // Return true if the policy evaluation is finished.
            return true;
        }
    }
    

另请参见

任务

如何:创建自定义安全令牌提供程序

参考

SecurityTokenAuthenticator
SecurityTokenRequirement
SecurityTokenManager
UserNameSecurityToken

概念

演练:创建自定义客户端和服务凭据
安全体系结构