在IIS託管的WCF服務中使用IdentityServer令牌

Question

我想在IIS託管的WCF服務中使用（消費）IdentityServer令牌。我已經看到Dominick提供的自定義WCF服務樣本。但是因爲我的WCF服務託管在IIS中，所以我需要在web.config文件中配置綁定和標識服務器配置選項。 任何人都可以與IdentityServer配置共享web.config文件嗎？ 請找我目前的配置如下：

<?xml version="1.0"?> 
<configuration> 
<appSettings> 
<add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" /> 
</appSettings> 
<system.web> 
<compilation debug="true" targetFramework="4.5.2" /> 
<httpRuntime targetFramework="4.5.2"/> 
</system.web> 
<system.serviceModel> 
<bindings> 
    <ws2007FederationHttpBinding> 
    <binding name="WS2007FederationHttpBinding_IService1"> 
     <security mode="TransportWithMessageCredential"> 
     <message establishSecurityContext="false" issuedKeyType="BearerKey"> 
      <issuer address="https://localhost/dentityServer" /> 
     </message> 
     </security> 
    </binding> 
    </ws2007FederationHttpBinding> 
</bindings> 
<client> 
    <endpoint address="https://localhost/IDPWcfService1/Service1.svc" 
      binding="ws2007FederationHttpBinding" bindingConfiguration="WS2007FederationHttpBinding_IService1" 
      contract="WcfService1.IService1" name="WS2007FederationHttpBinding_IService1" ></endpoint> 
</client> 
<behaviors> 
    <serviceBehaviors> 
    <behavior> 
     <!-- To avoid disclosing metadata information, set the values below to false before deployment --> 
     <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/> 
     <!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information --> 
     <serviceDebug includeExceptionDetailInFaults="false"/> 
    </behavior> 
    </serviceBehaviors> 
</behaviors> 
<protocolMapping> 
    <add binding="basicHttpsBinding" scheme="https" /> 
</protocolMapping>  
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /> 
</system.serviceModel> 
<system.webServer> 
<modules runAllManagedModulesForAllRequests="true"/> 
<!-- 
    To browse web app root directory during debugging, set the value below to true. 
    Set to false before deployment to avoid disclosing web app folder information. 
    --> 
<directoryBrowse enabled="true"/> 
</system.webServer> 

</configuration> 

Answer 1

我在這裏做同樣的事情的中間，你需要添加自定義XML包裝類來封裝智威湯遜（這簡直是將傳遞安全令牌從客戶每次調用服務，以便您可以驗證客戶端）

你可以找到這篇文章在這裏對更多的細節：https://leastprivilege.com/2015/07/02/give-your-wcf-security-architecture-a-makeover-with-identityserver3/

一旦這一步完成後，你需要添加這個自定義XML包裝到網站.config像這樣：

<system.identityModel> 
    <identityConfiguration saveBootstrapContext="true"> 
     <securityTokenHandlers> 
     <remove type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=abcdefg123456789"/>   
     <add type="Web.stuff.ServerSideAuthentication.IdentityServerWrappedJwtHandler, Web.stuff" /> 
     </securityTokenHandlers> 
    </identityConfiguration> 
    </system.identityModel> 

另外不要忘記在configsections節點下爲這個新節添加一個decalration。