HOW TO：建立自訂用戶端身分識別驗證器

發行項
02/28/2011

Windows Communication Foundation (WCF) 的「身分識別」(Identity) 功能可讓用戶端預先指定預期的服務身分識別。每當伺服器向用戶端驗證自身時，就會比對預期身分識別來檢查身分識別 (如需身分識別及其運作方式的說明，請參閱服務身分識別和驗證)。

必要時，可使用自訂身分識別驗證器來自訂驗證。例如，您可以執行其他服務身分識別驗證檢查。在這個範例中，自訂身分識別驗證器會檢查從伺服器所傳回的 X.509 憑證中的其他宣告。如需範例應用程式，請參閱服務身分識別範例

若要擴充 EndpointIdentity 類別

定義衍生自 EndpointIdentity 類別的新類別。這個範例會將擴充功能命名為 OrgEndpointIdentity。

加入私用成員與擴充 IdentityVerifier 類別將會使用的屬性，對服務所傳回安全性權杖中的宣告執行身分識別檢查。這個範例會定義一個屬性：OrganizationClaim 屬性。

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

若要擴充 IdentityVerifier 類別

定義衍生自 IdentityVerifier 的新類別。這個範例會將擴充功能命名為 CustomIdentityVerifier。

Public Class CustomIdentityVerifier
    Inherits IdentityVerifier
    ' Code to be added.

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Throw New Exception("The method or operation is not implemented.")
    End Function
End Class

public class CustomIdentityVerifier : IdentityVerifier
{
    // Code to be added.
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        throw new Exception("The method or operation is not implemented.");
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        throw new Exception("The method or operation is not implemented.");
    }
}

覆寫 CheckAccess 方法。這個方法會判斷身分識別檢查是成功還是失敗。

CheckAccess 方法有兩個參數。第一個是 EndpointIdentity 類別的執行個體。第二個是 AuthorizationContext 類別的執行個體。

在方法實作中，檢查 AuthorizationContext 類別的 ClaimSets 屬性傳回的宣告集合，並執行必要的驗證檢查。這個範例會先尋找 "Distinguished Name" 型別的任何宣告，然後比較名稱與 EndpointIdentity 的擴充功能 (OrgEndpointIdentity)。

Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                      ByVal authContext As AuthorizationContext) As Boolean

    Dim returnvalue = False
    For Each claimset In authContext.ClaimSets
        For Each claim In claimset
            If claim.ClaimType = "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                Dim name = CType(claim.Resource, X500DistinguishedName)
                If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                    Console.WriteLine("Right: {0}", claim.Right)
                    Console.WriteLine("Resource: {0}", claim.Resource)
                    Console.WriteLine()
                    returnvalue = True
                End If
            End If
        Next claim
    Next claimset
    Return returnvalue

End Function

public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
{
    bool returnvalue = false;

    foreach (ClaimSet claimset in authContext.ClaimSets)
    {
        foreach (Claim claim in claimset)
        {
            if (claim.ClaimType == "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
            {
                X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                {
                    Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                    Console.WriteLine("Right: {0}", claim.Right);
                    Console.WriteLine("Resource: {0}", claim.Resource);
                    Console.WriteLine();
                    returnvalue = true;
                }
            }
        }

    }
    return returnvalue;
}

若要實作 TryGetIdentity 方法

實作 TryGetIdentity 方法，可判斷 EndpointIdentity 類別的執行個體是否可由用戶端傳回。WCF 基礎結構會先呼叫 TryGetIdentity 方法的實作，從訊息擷取服務的身分識別。接著，基礎結構會使用所傳回的 EndpointIdentity 和 AuthorizationContext 來呼叫 CheckAccess 實作。

在 TryGetIdentity 方法中，放入下列程式碼：

Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                         <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
    Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
End Function

public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
{
    return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
}

若要實作自訂繫結及設定自訂 IdentityVerifier

建立會傳回 Binding 物件的方法。這個範例會先建立 WSHttpBinding 類別的執行個體，並將其安全性模式設定為 Message 及其 ClientCredentialType 設定為 None。
使用 CreateBindingElements 方法來建立 BindingElementCollection。
從集合中傳回 SecurityBindingElement 並將其轉換為 SymmetricSecurityBindingElement 變數。

將 LocalClientSecuritySettings 類別的 IdentityVerifier 屬性設定為先前新建立的 CustomIdentityVerifier 類別執行個體。

Public Shared Function CreateCustomSecurityBinding() As Binding
    Dim binding As New WSHttpBinding(SecurityMode.Message)

    With binding.Security.Message
        'Clients are anonymous to the service.
        .ClientCredentialType = MessageCredentialType.None
        'Secure conversation is turned off for simplification. If secure conversation is turned on, then 
        'you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
        .EstablishSecurityContext = False
    End With
    ' Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    Dim outputBec = binding.CreateBindingElements()
    Dim ssbe = CType(outputBec.Find(Of SecurityBindingElement)(), SymmetricSecurityBindingElement)

    'Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = New CustomIdentityVerifier()

    Return New CustomBinding(outputBec)
End Function

public static Binding CreateCustomSecurityBinding()
{
    WSHttpBinding binding = new WSHttpBinding(SecurityMode.Message);
    //Clients are anonymous to the service.
    binding.Security.Message.ClientCredentialType = MessageCredentialType.None;
    //Secure conversation is turned off for simplification. If secure conversation is turned on, then 
    //you also need to set the IdentityVerifier on the secureconversation bootstrap binding.
    binding.Security.Message.EstablishSecurityContext = false;

    // Get the SecurityBindingElement and cast to a SymmetricSecurityBindingElement to set the IdentityVerifier.
    BindingElementCollection outputBec = binding.CreateBindingElements();
    SymmetricSecurityBindingElement ssbe = (SymmetricSecurityBindingElement)outputBec.Find<SecurityBindingElement>();

    //Set the Custom IdentityVerifier.
    ssbe.LocalClientSettings.IdentityVerifier = new CustomIdentityVerifier();

    return new CustomBinding(outputBec);
}

所傳回的自訂繫結會用來建立用戶端和類別的執行個體。然後，用戶端就可以對服務執行自訂身分識別驗證檢查，如下列程式碼所示。
```
Using client As New CalculatorClient(customSecurityBinding, serviceAddress)
```
```
using (CalculatorClient client = new CalculatorClient(customSecurityBinding, serviceAddress))
{
```

範例

下列範例會示範 IdentityVerifier 類別的完整實作。

Friend Class CustomIdentityVerifier
    Inherits IdentityVerifier

    Public Overrides Function CheckAccess(ByVal identity As EndpointIdentity, _
                                          ByVal authContext As AuthorizationContext) As Boolean

        Dim returnvalue = False
        For Each claimset In authContext.ClaimSets
            For Each claim In claimset
                If claim.ClaimType = "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname" Then
                    Dim name = CType(claim.Resource, X500DistinguishedName)
                    If name.Name.Contains((CType(identity, OrgEndpointIdentity)).OrganizationClaim) Then
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType)
                        Console.WriteLine("Right: {0}", claim.Right)
                        Console.WriteLine("Resource: {0}", claim.Resource)
                        Console.WriteLine()
                        returnvalue = True
                    End If
                End If
            Next claim
        Next claimset
        Return returnvalue

    End Function

    Public Overrides Function TryGetIdentity(ByVal reference As EndpointAddress, _
                                             <System.Runtime.InteropServices.Out()> ByRef identity As EndpointIdentity) As Boolean
        Return IdentityVerifier.CreateDefault().TryGetIdentity(reference, identity)
    End Function

End Class

class CustomIdentityVerifier : IdentityVerifier
{
    public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)
    {
        bool returnvalue = false;

        foreach (ClaimSet claimset in authContext.ClaimSets)
        {
            foreach (Claim claim in claimset)
            {
                if (claim.ClaimType == "https://schemas.microsoft.com/ws/2005/05/identity/claims/x500distinguishedname")
                {
                    X500DistinguishedName name = (X500DistinguishedName)claim.Resource;
                    if (name.Name.Contains(((OrgEndpointIdentity)identity).OrganizationClaim))
                    {
                        Console.WriteLine("Claim Type: {0}", claim.ClaimType);
                        Console.WriteLine("Right: {0}", claim.Right);
                        Console.WriteLine("Resource: {0}", claim.Resource);
                        Console.WriteLine();
                        returnvalue = true;
                    }
                }
            }

        }
        return returnvalue;
    }

    public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)
    {
        return IdentityVerifier.CreateDefault().TryGetIdentity(reference, out identity);
    }
}

下列範例會示範 EndpointIdentity 類別的完整實作。

Public Class OrgEndpointIdentity
    Inherits EndpointIdentity
    Private orgClaim As String

    Public Sub New(ByVal orgName As String)
        orgClaim = orgName
    End Sub

    Public Property OrganizationClaim() As String
        Get
            Return orgClaim
        End Get
        Set(ByVal value As String)
            orgClaim = value
        End Set
    End Property
End Class

public class OrgEndpointIdentity : EndpointIdentity
{
    private string orgClaim;
    public OrgEndpointIdentity(string orgName)
    {
        orgClaim = orgName;
    }

    public string OrganizationClaim
    {
        get { return orgClaim; }
        set { orgClaim = value; }
    }
}

共用方式為

HOW TO：建立自訂用戶端身分識別驗證器

若要擴充 EndpointIdentity 類別

若要擴充 IdentityVerifier 類別

若要實作 TryGetIdentity 方法

若要實作自訂繫結及設定自訂 IdentityVerifier

範例

另請參閱

工作

參考

其他資源