如何在WCF解决方案中使用WCS（windows cardspace）作为身份验证方式

最新推荐文章于 2025-08-12 18:32:44 发布

原创最新推荐文章于 2025-08-12 18:32:44 发布 · 932 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#wcf #windows #binding #security #service #behavior

[随笔分类]Microsoft .NET 专栏收录该内容

441 篇文章

订阅专栏

本文详述了在WCF解决方案中集成WCS（Windows CardSpace）作为身份验证方法的步骤，包括服务契约设置、客户端证书处理及异常处理。读者需具备WCF基础知识。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

本文提供了一个引导步骤，讲解了如何在WCF解决方案中采用WCS作为身份验证方式。本文假设你已经清楚地了解了WCF的各项机制。

第一部分：服务部分

1. 服务契约

using System.ServiceModel;

namespace HelloService
{
    [ServiceContract]
    public interface IHello
    {
        [OperationContract]
        string Say();
    }
}

2. 服务实现和宿主程序

需要预先引用System.ServiceModel，System.IdentityModel

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

using System.ServiceModel;
using System.IdentityModel.Claims;
using System.IdentityModel.Policy;

namespace HelloService
{


    class Hello : IHello
    {

        #region IHello 成员

        public string Say()
        {
            GetIdentity();
            return "Hello,World";
        }

        private void GetIdentity()
        {
            AuthorizationContext ctx =
OperationContext.Current.ServiceSecurityContext.AuthorizationContext;
            foreach (ClaimSet claimSet in ctx.ClaimSets)
            {
                foreach (Claim claim in claimSet)
                {
                    Console.WriteLine();
                    Console.WriteLine("ClaimType: " + claim.ClaimType);
                    Console.WriteLine("Resource: " + claim.Resource);
                    Console.WriteLine("Right: " + claim.Right);
                }
            }
            return;
        }

        #endregion
    }

    class Program
    {
        static void Main(string[] args)
        {
            ServiceHost sh = new ServiceHost(typeof(Hello), new Uri("http://localhost:4123/helloService"));
            sh.Open();
            Console.WriteLine("Service listening...");
            Console.WriteLine("Press 
  
    to finish"
  );
            Console.ReadLine();
            sh.Close(); // close the service
        }
    }
}

代码中的GetIdentity方法是我们自己写的，主要是为了解析Windows Cardspace传递过来的凭据信息。

3. 服务配置


  xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <services>
      <service
      name="HelloService.Hello"
      behaviorConfiguration="helloServiceBehavior">
        <endpoint
        address="helloEndpoint"
        contract="HelloService.IHello"
        binding="wsFederationHttpBinding"
        bindingConfiguration="helloFederatedBinding">

          <identity>
            <certificateReference
            findValue="WCFTestCert"
            storeLocation="CurrentUser"
            storeName="My"
            x509FindType="FindBySubjectName" />
          
   identity>
        
    endpoint>
        <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" />
      
     service>
    
      services>
    <bindings>
      <wsHttpBinding>
        <binding name="helloBinding">
          <security mode="Message">
            <message clientCredentialType="IssuedToken" />
          
       security> 
        binding> 
         wsHttpBinding> <wsFederationHttpBinding> <binding name="helloFederatedBinding" > <security mode="Message"> <message algorithmSuite="Basic128" issuedTokenType="urn:oasis:names:tc:SAML:1.0:assertion" issuedKeyType="SymmetricKey"> <issuer address="http://schemas.xmlsoap.org/ws/2005/05/identity/issuer/self"/> <claimTypeRequirements> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/> 
          claimTypeRequirements> 
           message> 
            security> 
             binding> 
              wsFederationHttpBinding> 
               bindings> <behaviors> <serviceBehaviors> <behavior name="helloServiceBehavior"> <serviceMetadata httpGetEnabled="true" /> <serviceCredentials> <issuedTokenAuthentication allowUntrustedRsaIssuers="true" /> <serviceCertificate findValue="WCFTestCert" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /> 
                serviceCredentials> 
                 behavior> 
                  serviceBehaviors> 
                   behaviors> 
                    system.serviceModel> 
                     configuration>

在这里，我们指定了一个特殊的binding(wsFederationHttpBinding)这是专用于WCS的。并且我们声明了当前应用程序需要两部分信息，一个是emailaddress，一个是givename

需要注意的是，我们需要在服务端设置证书，并且在endpoint对其进行引用，这是什么道理呢? 因为客户端也要对服务进行验证。

第二部分：客户端部分

1. 服务契约

using System.ServiceModel;

namespace HelloService
{
    [ServiceContract]
    public interface IHello
    {
        [OperationContract]
        string Say();
    }
}

2. 客户端代码

using System;

using System.ServiceModel;

namespace Client
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("Hit any key when service is ready");
            Console.ReadKey();
            ChannelFactory
 
   cnFactory =
            
  new ChannelFactory
  
   (
   "helloClient");
            HelloService.IHello chn = cnFactory.CreateChannel();
            Console.WriteLine(chn.Say());
            
   // Clean up
            cnFactory.Close(); 
   // close the client’s channel
            Console.WriteLine(
   "Press 
    
      to finish"
    );
            Console.ReadLine();
        }
    }
}

3. 客户端配置


  xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.serviceModel>
    <client>
      <endpoint
      name="helloClient"
      address="http://localhost:4123/helloService/helloEndpoint"
      contract="HelloService.IHello"
      binding="wsFederationHttpBinding"
      bindingConfiguration="helloFederatedBinding"
      behaviorConfiguration="helloClientBehavior">
        <identity>
          <certificateReference
          findValue="WCFTestCert"
          storeLocation="CurrentUser"
          storeName="My"
          x509FindType="FindBySubjectName" />
        
   identity>
      
    endpoint>
    
     client>
    <bindings>
      <wsHttpBinding>
        <binding name="helloBinding">
          <security mode="Message">
            <message clientCredentialType="IssuedToken" />
          
      security>
        
       binding> 
        wsHttpBinding> <wsFederationHttpBinding> <binding name="helloFederatedBinding" > <security mode="Message"> <message algorithmSuite="Basic128" issuedTokenType="urn:oasis:names:tc:SAML:1.0:assertion" issuedKeyType="SymmetricKey"> <issuer address="http://schemas.xmlsoap.org/ws/2005/05/identity/issuer/self"/> <claimTypeRequirements> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/> <add claimType ="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"/> 
         claimTypeRequirements> 
          message> 
           security> 
            binding> 
             wsFederationHttpBinding> 
              bindings> <behaviors> <endpointBehaviors> <behavior name="helloClientBehavior"> <clientCredentials> <serviceCertificate> <authentication trustedStoreLocation="CurrentUser" revocationMode="NoCheck"/> <defaultCertificate findValue="WCFTestCert" storeLocation="CurrentUser" storeName="My" x509FindType="FindBySubjectName" /> 
               serviceCertificate> 
                clientCredentials> 
                 behavior> 
                  endpointBehaviors> 
                   behaviors> 
                    system.serviceModel> 
                     configuration>

也就是说，在客户端也是需要包含证书的。一般是把不包含私钥的证书在客户端安装。

4. 运行效果

服务端

客户端

[备注]因为是Session的隔离，所以选择卡片的界面是没有办法截图的。

4. 为客户端实现异常处理

添加System.IdentityModel.Selectors引用

using System;

using System.ServiceModel;
using System.IdentityModel.Selectors;

namespace Client
{
    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                Console.WriteLine("Hit any key when service is ready");
                Console.ReadKey();
                ChannelFactory
 
   cnFactory = 
  new
                ChannelFactory
  
   (
   "helloClient");
                HelloService.IHello chn = cnFactory.CreateChannel();
                Console.WriteLine(chn.Say());
                cnFactory.Close();
            }
            
   catch (UserCancellationException)
            {
                Console.WriteLine(
   "User cancelled");
            }
            
   catch (UntrustedRecipientException)
            {
                Console.WriteLine(
   "User does not trust the recipient");
            }
            
   catch (ServiceNotStartedException)
            {
                Console.WriteLine(
   "Cardspace service not started");
            }
            
   catch (CardSpaceException cse)
            {
                Console.WriteLine(
   "Generic Cardspace exception:" + cse.Message);
            }
            
   catch (Exception e)
            {
                Console.WriteLine(
   "Other exceptions :" + e.Message);
            }
            
   finally
            {
                Console.WriteLine(
   "Press 
    
      to finish"
    );
                Console.ReadLine();
            }
        }
    }
}