wcf-security | 易学教程

Why doesn't my WCF endpoint throw a Max Clock Skew exception?

阅读更多关于 Why doesn't my WCF endpoint throw a Max Clock Skew exception?

问题 With almost all of the (secure) WCF service endpoints in my application, if the client's system clock is set too far in the future or past, I get an exception from WCFs Clock Skew mechanism (described here: http://www.danrigsby.com/blog/index.php/2008/08/26/changing-the-default-clock-skew-in-wcf/). However the one endpoint where my Login() method is implemented never throws this exception even though it has transport security enabled (naturally no credentials are required for it). Why isn't

WCF - Disabling security in nettcpbinding (c#)

阅读更多关于 WCF - Disabling security in nettcpbinding (c#)

问题 I'm trying to make a self hosted WCF app that uses nettcpbinding but works in an environment without a domain. It's just two regular windows pc's, one is the server and the other one will be the client. The problem with this is that when I try to get the client to connect it's rejected because of the security settings. Can you please point me in the right direction as to how I can get this scenario to work? Should I (if possible) disable security? Is there another (hopefully simple) way to

How can I ensure that IsInRole checks are not using cached credentials

阅读更多关于 How can I ensure that IsInRole checks are not using cached credentials

问题 I have a WPF client that connects to a WCF service, and I want to lock down some of the functionality so that only certain users can perform certain actions. The WCF service impersonates the client user when executing service methods. The OS is Windows XP. I was reading this question as part of my investigation into the best way to apply user roles to features in my application (I want to assign users to AD security groups, and then check IsInRole), and am worried that cached permissions will

How to save user object in WCF

阅读更多关于 How to save user object in WCF

问题 I have a service that uses a custom "UserNamePasswordValidator" and need to save the validated user object to be able to retrieve it later in the service. How can I do this? Or how can I access the credentials of the user later in the service? /Viktor 回答1: The short answer is that the most correct option is to create an IPrincipal instance that represents the authenticated user and put it on Thread.CurrentPrincipal. All code running on the same thread later in the service will be able to

Silverlight WCF Authentication (Help going from WPF to Silverlight)

阅读更多关于 Silverlight WCF Authentication (Help going from WPF to Silverlight)

I have an existing working WPF Application in which I have implemented my own custom authentication to a backend WCF service. When I access this service from WPF, setup the ServiceProxy as follows: proxy.ClientCredentials.UserName.UserName = "test"; proxy.ClientCredentials.UserName.Password = "pass"; and because I'm using HTTPS the uid/pwd is secure. In Silverlight 2 there is no .ClientCredentials object on the proxy. The only option I've found is to add two string parameters to EVERY WCF Exposed method for Uid/Pwd. That sounds like insanity to me, there MUST be a better way, no? Unfortunately

wcf server authentication without certificates

阅读更多关于 wcf server authentication without certificates

I have a self-hosted WCF service with netTcpBinding bindings. Both my servers and clients will all be in the same domain, so I'd like to use windows authentication, but I'd also like the clients to verify server credentials (to avoid an internal man-in-the-middle/dns tampering attack). I've read that the way to do this is to use an SPN, but I can't seem to get that to work; no matter what the spn is set to the client works (i.e. the server and client don't match, but the client connects anyway). Obviously I've got some kind of configuration error, but I'm not sure where. Here is the service

WCF “Basic” transport security issue when hosted in IIS

阅读更多关于 WCF “Basic” transport security issue when hosted in IIS

I am attempting to secure a new .Net 4.5 WCF service using HTTPS / SSL, Basic client credentials and the WebHttpBinding . From reading up online I found a good series of Blog Posts from Allen Conway which I have used as a template. WCF configuration <system.serviceModel> <bindings> <webHttpBinding> <binding name="webInteropSecureBinding" allowCookies="false" maxBufferPoolSize="2097152" maxBufferSize="2097152" maxReceivedMessageSize="2097152"> <security mode="Transport"> <transport clientCredentialType="Basic"></transport> </security> </binding> </webHttpBinding> </bindings> <services> <service

X509Certificate Implementation best practices

阅读更多关于 X509Certificate Implementation best practices

Firstly, Thanks to all those patient techies trying to help unknown people. Secondly, I have a wcf service which should be consumed by only several clients (10) known to our company. This wcf service has the x509certificate "CN=ABCD". Now it expects to receive a certificate in turn from clients to consume this service. So here are the design questions Should I create one certificate "CN=ABCD" , then right click on it and export as pfx files and distribute them to Clients? Some say to validate in code and some say to validate in config which is better? How should I know which client is calling

WCF Service Impersonation

阅读更多关于 WCF Service Impersonation

问题 Good Day Everyone... Apparently, I'm not setting-up impersonation correctly for my WCF service. I do NOT want to set security on a method-by-method basis (in the actual code-behind). The service (at the moment) is open to be called by everyone on the intranet. So my questions are… Q: What web-config tags am I missing? Q: What do I need to change in the web-config to make impersonation work? The Service Web.config Looks Like... <configuration> <system.web> <authorization> <allow users="?"/> <

stop WCF from caching / re-using security tokens (SecurityContextToken)

阅读更多关于 stop WCF from caching / re-using security tokens (SecurityContextToken)

I am using WCF Message level security with the following wsHttpBinding <security mode="Message"> <message clientCredentialType="Windows" establishSecurityContext="false" /> </security> Each time i call the service is a separate operation, and there is no need to keep any session state. I am running into a problem with load balancer, because WCF keeps re-using security tokens, so if the first call goes to NodeA, it creates a security token which is re-used. If that token is passed to NodeB tripping up MessageSecurityException Seems like microsofts answer to this is to use sticky sessions, which