如何：创建自定义安全令牌身份验证器

项目
04/07/2023

本主题演示如何创建自定义安全令牌身份验证器以及如何将其与自定义安全令牌管理器相集成。安全令牌身份验证器可验证随传入消息一起提供的安全令牌的内容。如果验证成功，身份验证器将返回 IAuthorizationPolicy 实例的集合，该集合经过计算后可返回一组声明。

若要在 Windows Communication Foundation (WCF) 中使用自定义安全令牌身份验证器，首先必须创建自定义凭据和安全令牌管理器实现。有关创建自定义凭据和安全令牌管理器的详细信息，请参阅演练：创建自定义客户端和服务凭据。

过程

创建自定义安全令牌身份验证器

定义一个从 SecurityTokenAuthenticator 类派生的新类。
重写 CanValidateTokenCore 方法。此方法返回 true 或 false，具体取决于自定义身份验证器是否可以验证传入的令牌类型。

重写 ValidateTokenCore 方法。此方法需要适当地验证令牌内容。如果此令牌通过验证步骤，它将返回 IAuthorizationPolicy 实例的集合。下面的示例使用将在后面的过程中创建的自定义授权策略实现。

internal class MySecurityTokenAuthenticator : SecurityTokenAuthenticator
{
    protected override bool CanValidateTokenCore(SecurityToken token)
    {
        // Check that the incoming token is a username token type that
        // can be validated by this implementation.
        return (token is UserNameSecurityToken);
    }

    protected override ReadOnlyCollection<IAuthorizationPolicy>
        ValidateTokenCore(SecurityToken token)
    {
        UserNameSecurityToken userNameToken = token as UserNameSecurityToken;

        // Validate the information contained in the username token. For demonstration
        // purposes, this code just checks that the user name matches the password.
        if (userNameToken.UserName != userNameToken.Password)
        {
            throw new SecurityTokenValidationException("Invalid user name or password");
        }

        // Create just one Claim instance for the username token - the name of the user.
        DefaultClaimSet userNameClaimSet = new DefaultClaimSet(
            ClaimSet.System,
            new Claim(ClaimTypes.Name, userNameToken.UserName, Rights.PossessProperty));
        List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>(1);
        policies.Add(new MyAuthorizationPolicy(userNameClaimSet));
        return policies.AsReadOnly();
    }
}

Friend Class MySecurityTokenAuthenticator
    Inherits SecurityTokenAuthenticator

    Protected Overrides Function CanValidateTokenCore(ByVal token As SecurityToken) As Boolean
        ' Check that the incoming token is a username token type that  
        ' can be validated by this implementation.
        Return (TypeOf token Is UserNameSecurityToken)
    End Function

    Protected Overrides Function ValidateTokenCore(ByVal token As SecurityToken) As ReadOnlyCollection(Of IAuthorizationPolicy)

        Dim userNameToken = TryCast(token, UserNameSecurityToken)

        ' Validate the information contained in the username token. For demonstration 
        ' purposes, this code just checks that the user name matches the password.
        If userNameToken.UserName <> userNameToken.Password Then
            Throw New SecurityTokenValidationException("Invalid user name or password")
        End If

        ' Create just one Claim instance for the username token - the name of the user.
        Dim userNameClaimSet As New DefaultClaimSet(ClaimSet.System, _
                                                    New Claim(ClaimTypes.Name, _
                                                    userNameToken.UserName, _
                                                    Rights.PossessProperty))
        Dim policies As New List(Of IAuthorizationPolicy)(1)
        policies.Add(New MyAuthorizationPolicy(userNameClaimSet))
        Return policies.AsReadOnly()
    End Function

End Class

前面的代码在 CanValidateToken(SecurityToken) 方法中返回授权策略的集合。 WCF 不提供此接口的公共实现。下面的过程演示如何针对您自己的需求实现此目的。

创建自定义授权策略

定义一个实现 IAuthorizationPolicy 接口的新类。
实现 Id 只读属性。实现此属性的一个方法是在类构造函数中生成一个全局唯一标识符 (GUID)，并在每次请求此属性的值时返回该标识符。
实现 Issuer 只读属性。此属性需要返回从令牌获取的声明集的颁发者。此颁发者应该与令牌颁发者负责验证令牌内容的颁发机构相对应。下面的示例使用了颁发者声明，该声明从前面的过程中创建的自定义安全令牌身份验证器传递给此类。自定义安全令牌身份验证器使用系统提供的声明集（由 System 属性返回）来表示用户名令牌的颁发者。

实现 Evaluate 方法。此方法使用基于传入安全令牌内容的声明来填充 EvaluationContext 类的实例（以自变量形式传入）。当此方法完成计算时返回 true。如果该实现依赖于为计算上下文提供附加信息的其他授权策略，则在计算上下文中不存在所要求的信息时，此方法可返回 false。在这种情况下，如果这些授权策略之中至少有一个修改了计算上下文，在计算为传入消息生成的所有其他授权策略后，WCF 将再次调用此方法。

internal class MyAuthorizationPolicy : IAuthorizationPolicy
{
    string id;
    ClaimSet tokenClaims;
    ClaimSet issuer;

    public MyAuthorizationPolicy(ClaimSet tokenClaims)
    {
        if (tokenClaims == null)
        {
            throw new ArgumentNullException("tokenClaims");
        }
        this.issuer = tokenClaims.Issuer;
        this.tokenClaims = tokenClaims;
        this.id = Guid.NewGuid().ToString();
    }

    public ClaimSet Issuer
    {
        get { return issuer; }
    }

    public string Id
    {
        get { return id; }
    }

    public bool Evaluate(EvaluationContext evaluationContext, ref object state)
    {
        // Add the token claim set to the evaluation context.
        evaluationContext.AddClaimSet(this, tokenClaims);

        // Return true if the policy evaluation is finished.
        return true;
    }
}

Friend Class MyAuthorizationPolicy
    Implements IAuthorizationPolicy

    Private _id As String
    Private _tokenClaims As ClaimSet
    Private _issuer As ClaimSet

    Public Sub New(ByVal tokenClaims As ClaimSet)
        If _tokenClaims Is Nothing Then
            Throw New ArgumentNullException("tokenClaims")
        End If
        Me._issuer = tokenClaims.Issuer
        Me._tokenClaims = tokenClaims
        Me._id = Guid.NewGuid().ToString()
    End Sub

    Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer
        Get
            Return _issuer
        End Get
    End Property

    Public ReadOnly Property Id() As String Implements System.IdentityModel.Policy.IAuthorizationComponent.Id
        Get
            Return _id
        End Get
    End Property

    Public Function Evaluate(ByVal evaluationContext As EvaluationContext, _
                             ByRef state As Object) As Boolean Implements IAuthorizationPolicy.Evaluate

        ' Add the token claim set to the evaluation context.
        evaluationContext.AddClaimSet(Me, _tokenClaims)
        ' Return true if the policy evaluation is finished.
        Return True
    End Function

End Class

演练：创建自定义客户端和服务凭据介绍了如何创建自定义凭据和自定义安全令牌管理器。若要使用此处创建的自定义安全令牌身份验证器，可以修改安全令牌管理器的实现，以便从 CreateSecurityTokenAuthenticator 方法返回自定义身份验证器。当传入适当的安全令牌要求时，该方法将返回身份验证器。

使自定义安全令牌身份验证器与自定义安全令牌管理器相集成

在自定义安全令牌管理器实现中重写 CreateSecurityTokenAuthenticator 方法。

向该方法添加逻辑，使其能够基于 SecurityTokenRequirement 参数返回您的自定义安全令牌身份验证器。如果令牌需求的令牌类型为用户名（由 UserName 属性表示），并且正在为其请求安全令牌身份验证器的消息方向为输入（由 Input 字段表示），则下面的示例将返回自定义安全令牌身份验证器。

internal class MyServiceCredentialsSecurityTokenManager :
    ServiceCredentialsSecurityTokenManager
{
    ServiceCredentials credentials;
    public MyServiceCredentialsSecurityTokenManager(ServiceCredentials credentials)
        : base(credentials)
    {
        this.credentials = credentials;
    }

    public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator
        (SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
    {
        // Return your implementation of the SecurityTokenProvider based on the
        // tokenRequirement argument.
        SecurityTokenAuthenticator result;
        if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
        {
            MessageDirection direction = tokenRequirement.GetProperty<MessageDirection>
                (ServiceModelSecurityTokenRequirement.MessageDirectionProperty);
            if (direction == MessageDirection.Input)
            {
                outOfBandTokenResolver = null;
                result = new MySecurityTokenAuthenticator();
            }
            else
            {
                result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
            }
        }
        else
        {
            result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
        }

        return result;
    }
}

Friend Class MyServiceCredentialsSecurityTokenManager
    Inherits ServiceCredentialsSecurityTokenManager

    Private credentials As ServiceCredentials

    Public Sub New(ByVal credentials As ServiceCredentials)
        MyBase.New(credentials)
        Me.credentials = credentials
    End Sub

    Public Overrides Function CreateSecurityTokenAuthenticator(ByVal tokenRequirement As SecurityTokenRequirement, _
                                                               <System.Runtime.InteropServices.Out()> _
                                                               ByRef outOfBandTokenResolver _
                                                               As SecurityTokenResolver) As SecurityTokenAuthenticator
        ' Return your implementation of the SecurityTokenProvider based on the 
        ' tokenRequirement argument.
        Dim result As SecurityTokenAuthenticator
        If tokenRequirement.TokenType = SecurityTokenTypes.UserName Then
            Dim direction = tokenRequirement.GetProperty(Of MessageDirection)(ServiceModelSecurityTokenRequirement.MessageDirectionProperty)
            If direction = MessageDirection.Input Then
                outOfBandTokenResolver = Nothing
                result = New MySecurityTokenAuthenticator()
            Else
                result = MyBase.CreateSecurityTokenAuthenticator(tokenRequirement, _
                                                                 outOfBandTokenResolver)
            End If
        Else
            result = MyBase.CreateSecurityTokenAuthenticator(tokenRequirement, _
                                                             outOfBandTokenResolver)
        End If

        Return result
    End Function

End Class

如何：创建自定义安全令牌身份验证器

过程

创建自定义安全令牌身份验证器

创建自定义授权策略

使自定义安全令牌身份验证器与自定义安全令牌管理器相集成

另请参阅

其他资源