c# - WCF 客户端缓存 Windows 身份验证

Question

我正在调用 Navision 公开的 Web 服务，它通过 Windows 身份验证进行保护。我能够成功调用它，但在那之后，它似乎以某种方式缓存了凭据，这让我很担心。

该服务托管在远程服务器上，与我的开发机器位于不同的域中。我正在从 Visual Studio 运行代码。

我已经创建了对服务的服务引用，我的 app.config 中没有配置，所以所有设置都是使用代码创建的。

首次运行(未指定客户端凭据):

var binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;

var address = new EndpointAddress("http://externalserver.com/DynamicsNAV/WS/Customer/Page/MyPage");

var client = new MyPage_PortClient(binding, address);
client.ClientCredentials.Windows.AllowNtlm = true;
client.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;

var reqObj = new MyPage() { TypeID = "Test", Company_Name = "Test:" + DateTime.Now.ToShortTimeString() };
client.Create(ref reqObj);
client.Close();
Console.WriteLine(reqObj.Company_Name);
Console.ReadLine();

这给了我一个安全异常。正如预期的那样。

第二次运行(使用凭据):

var binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;

var address = new EndpointAddress("http://externalserver.com/DynamicsNAV/WS/Customer/Page/MyPage");

var client = new MyPage_PortClient(binding, address);
client.ClientCredentials.Windows.ClientCredential.Domain = "MYDOM";
client.ClientCredentials.Windows.ClientCredential.UserName = "NavWebService";
client.ClientCredentials.Windows.ClientCredential.Password = "foo";
client.ClientCredentials.Windows.AllowNtlm = true;
client.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;

var reqObj = new MyPage() { TypeID = "Test", Company_Name = "Test:" + DateTime.Now.ToShortTimeString() };
client.Create(ref reqObj);
client.Close();
Console.WriteLine(reqObj.Company_Name);
Console.ReadLine();

调用成功。同样，正如预期的那样。

第三次运行，与第一次运行相同。也就是说，没有指定凭据。该调用成功。现在我很困惑。凭据必须以某种方式缓存？我重新启动我的机器，结果相同。仍然成功。

然后我尝试指定伪造的凭据:

var binding = new BasicHttpBinding();
binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Windows;

var address = new EndpointAddress("http://externalserver.com/DynamicsNAV/WS/Customer/Page/MyPage");

var client = new MyPage_PortClient(binding, address);
client.ClientCredentials.Windows.ClientCredential.Domain = "fakeMYDOM";
client.ClientCredentials.Windows.ClientCredential.UserName = "fakeNavWebService";
client.ClientCredentials.Windows.ClientCredential.Password = "badPwd";
client.ClientCredentials.Windows.AllowNtlm = true;
client.ClientCredentials.Windows.AllowedImpersonationLevel = TokenImpersonationLevel.Impersonation;

var reqObj = new MyPage() { TypeID = "Test", Company_Name = "Test:" + DateTime.Now.ToShortTimeString() };
client.Create(ref reqObj);
client.Close();
Console.WriteLine(reqObj.Company_Name);
Console.ReadLine();

此调用失败。正如预期的那样。

我再次回到第一个调用，它仍然成功。所以它实际上仍在缓存第一次成功调用的凭据，即使我同时尝试使用无效凭据也是如此。

谁能告诉我这是怎么回事？是不是我对 Windows 身份验证不了解？ Visual Studio/WCF 中是否有某种凭据缓存？

Answer 1

没错，Windows token 正在缓存中。这是关于 Impersonation and Delecation with WCF 的 MSDN 文章，其中涵盖了缓存 token 模拟。