WCF安全绑定(bind)问题

Question

您好，我创建了一个作为 WebRole 在 Windows Azure 项目中托管的 WCF 服务。

我的服务受 SSL 证书保护，并且有效。
现在我想在我的操作契约(Contract)上添加一些额外的安全性，如果我这样做(设置保护级别)，我会收到下一个错误。

我需要配置一些绑定(bind)或其他东西才能完成这项工作，但我不知道什么，也不知道在哪里。

项目信息:

错误:

    The request message must be protected. This is required by an operation of the contract ('IService1','http://tempuri.org/').
    The protection must be provided by the binding ('BasicHttpBinding','http://tempuri.org/').

架构

ServiceConfiguration.Cloud.cscfg 和 ServiceConfiguration.Local.cscfg

<?xml version="1.0" encoding="utf-8"?>
<ServiceConfiguration serviceName="Azure" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration" osFamily="1" osVersion="*">
  <Role name="WCFServiceWebRole">
    <Instances count="1" />
    <ConfigurationSettings>
      <Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" value="UseDevelopmentStorage=true" />
    </ConfigurationSettings>
    <Certificates>
      <Certificate name="Certificate1" thumbprint="51F357715F" thumbprintAlgorithm="sha1" />
    </Certificates>
  </Role>
</ServiceConfiguration>

ServiceDefinition.csdef

<?xml version="1.0" encoding="utf-8"?>
<ServiceDefinition name="Azure" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceDefinition">
  <WebRole name="WCFServiceWebRole" vmsize="ExtraSmall" enableNativeCodeExecution="true">
    <Sites>
      <Site name="Web">
        <Bindings>
          <Binding name="Endpoint1" endpointName="Endpoint1" />
          <Binding name="Endpoint2" endpointName="Endpoint2" />
        </Bindings>
      </Site>
    </Sites>
    <Endpoints>
      <InputEndpoint name="Endpoint1" protocol="http" port="80" />
      <InputEndpoint name="Endpoint2" protocol="https" port="8080" certificate="Certificate1" />
    </Endpoints>
    <Imports>
      <Import moduleName="Diagnostics" />
    </Imports>
    <LocalResources>
      <LocalStorage name="WCFServiceWebRole.svclog" sizeInMB="1000" cleanOnRoleRecycle="false" />
    </LocalResources>
    <Certificates>
      <Certificate name="Certificate1" storeLocation="LocalMachine" storeName="My" />
    </Certificates>
  </WebRole>
</ServiceDefinition>

契约(Contract)

[DataContract]
public class KlantenContract
{
    [DataMember]
    public int PARTYID { get; set; }

    [DataMember]
    public string firstName { get; set; }

    [DataMember]
    public string lastName { get; set; }

IService1.cs

namespace WCFServiceWebRole
{
    [ServiceContract(ProtectionLevel = ProtectionLevel.EncryptAndSign)]
    public interface IService1
    {
        [OperationContract(ProtectionLevel = ProtectionLevel.EncryptAndSign)]
        List<KlantenContract> GetAllKlanten(string firstName);
    }
}

Web.config

  <system.serviceModel>

    <bindings>
      <wsHttpBinding>
        <binding name="IService1">
          <security mode="Transport"></security>
        </binding>
        <binding name="Certificate1">
          <security>
            <message clientCredentialType="Certificate"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

    <services>
      <service name="Service1" behaviorConfiguration="ServiceBehavior">
        <endpoint address="https://127.0.0.1:8080/Service1.svc" binding="wsHttpBinding"
          name="Endpoint2" contract="IService1">
        </endpoint>
      </service>
    </services>

    <behaviors>
      <serviceBehaviors>

          <behavior name="ServiceBehavior">
            <serviceMetadata httpGetEnabled="true" />
            <serviceDebug includeExceptionDetailInFaults="false" />
            <serviceCredentials>
              <serviceCertificate findValue="CN=tempCert" />
            </serviceCredentials>
          </behavior>

          <behavior>
          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
  </system.serviceModel>

Answer 1

如果您将服务设置为 EncryptAndSign，则它必须使用安全传输，例如 HTTPS。我不知道您在上一个屏幕截图中是通过 HTTP 还是 HTTPS 查看服务，但您必须使用 HTTPS。

如果您希望 IIS 处理安全绑定(bind)，您只需将安全模式设置为 TransportWithCredentialOnly，并将您的 Web 角色配置为使用您的证书绑定(bind)到 443，我认为您已经这样做了，然后就可以了应该没问题。

或者，您可以使用传输安全性，并且在 ServerCredential 部分中，您需要指定希望 WCF 使用哪个证书来创建安全传输。

我从未尝试过消息安全模式，但我认为它应该可以工作，但您可能还需要在消息安全配置元素下指定证书。