c# - 当我需要服务进行 NTLM 身份验证时如何公开 MEX

Question

我正在开发 RESTful 和 SOAP 的 WCF 服务，现在它们都需要使用 NTLM 身份验证。

我还想公开一个 MEX 端点，以便其他人可以轻松引用该服务并使用它。

现在，当我将 IIS 设置为需要 Windows 身份验证时，我可以使用 REST 服务并成功调用该服务，但是当我想使用 SVCUTIL 引用该服务时，它会抛出一个错误，提示它需要匿名。

这是我的 web.config:

<system.serviceModel>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/>
<bindings>
  <basicHttpBinding>
    <binding name="basicHttpBinding" maxReceivedMessageSize="214748563" maxBufferSize="214748563" maxBufferPoolSize="214748563">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Ntlm">

        </transport>
      </security>
    </binding>
  </basicHttpBinding>
  <webHttpBinding>
    <binding name="webHttpBinding" maxReceivedMessageSize="214748563" maxBufferSize="214748563" maxBufferPoolSize="214748563">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Ntlm">

        </transport>
      </security>
    </binding>
  </webHttpBinding>
  <mexHttpBinding>
    <binding name="mexHttpBinding"></binding>
  </mexHttpBinding>
</bindings>
<standardEndpoints>
  <webHttpEndpoint>
    <standardEndpoint name="" automaticFormatSelectionEnabled="true" helpEnabled="True">
    </standardEndpoint>
  </webHttpEndpoint>
</standardEndpoints>
<services>
  <service name="Intel.ResourceScheduler.Service" behaviorConfiguration="Meta">
    <clear />
    <endpoint address="soap" name="SOAP" binding="basicHttpBinding" contract="Intel.ResourceScheduler.Service.IResourceSchedulerService" listenUriMode="Explicit" />
    <endpoint address="" name="rest" binding="webHttpBinding" behaviorConfiguration="REST" contract="Intel.ResourceScheduler.Service.IResourceSchedulerService" />
    <endpoint address="mex" name="mex" binding="mexHttpBinding" behaviorConfiguration="" contract="IMetadataExchange" />
  </service>
</services>
<behaviors>
  <endpointBehaviors>
    <behavior name="REST">
      <webHttp />
    </behavior>
    <behavior name="WCFBehavior">
      <dataContractSerializer maxItemsInObjectGraph="2147483647" />
    </behavior>

  </endpointBehaviors>
  <serviceBehaviors>
    <behavior name="Meta">
      <serviceMetadata httpGetEnabled="true"/>
    </behavior>
    <behavior name="REST">
      <dataContractSerializer maxItemsInObjectGraph="2147483647" />
    </behavior>
    <behavior name="WCFBehavior">
      <serviceMetadata httpGetEnabled="true"/>
      <dataContractSerializer maxItemsInObjectGraph="2147483647" />
    </behavior>
    <behavior name="">
      <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
      <serviceMetadata httpGetEnabled="true" />
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug includeExceptionDetailInFaults="false" />
    </behavior>
  </serviceBehaviors>
</behaviors>

我们将不胜感激。

Answer 1

尝试更改 mex 服务的绑定(bind)，它不能与 mexHttpBinding 一起使用，因为它已禁用安全性。我没有在完全相同的场景中对此进行测试，但就我而言，出于安全考虑，我也不得不对其进行更改。

在您的示例中，我会尝试这样更改它:

<endpoint address="mex" contract="IMetadataExchange" binding="basicHttpBinding" bindingConfiguration="basicHttpBinding"/>

要使 mex 绑定(bind)配置更加独立于 soap 服务绑定(bind)配置，还可以定义和使用单独的 bindingConfiguration，例如

<binding name="secureMexHttpBinding" >
  <security mode="TransportCredentialOnly">
    <transport clientCredentialType="Ntlm">
    </transport>
  </security>
</binding>

然后更改 mex 端点

endpoint address="mex" contract="IMetadataExchange" binding="basicHttpBinding" bindingConfiguration="secureMexHttpBinding"/>