DotNetOpenAuth实践之WCF资源服务器配置

系列目录：

DotNetOpenAuth实践系列（源码在这里）

上一篇我们写了一个OAuth2的认证服务器，我们也获取到access_token，那么这个token怎么使用呢，我们现在就来揭开

一般获取access_token用处就是访问接口资源，不然也用不到怎么大费周章的还要获取个token再去访问资源

而接口有几类：

WCF服务接口，WebApi，还有自己用如ashx，aspx写的接口提供给前端调用的接口

其中WCF接口DotNetOpenAuth.Sample例子中已经做了

这些接口公开对外就需要一个认证的过程才能访问（当然内部或者内网使用的也不用这么麻烦，毕竟认证也是影响性能的）

废话不多说，我们下面开始搭建资源服务器

首先，搭建WCF服务接口的资源认证

一、创建WCF资源服务器项目

2、添加DotNetOpenAuth到项目中

3、添加WCF服务，为了方便，我们添加支持ajax的wcf服务

4、重写ServiceAuthorizationManager

using System;
using System.Collections.Generic;
using System.IdentityModel.Policy;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Security.Principal;
using System.ServiceModel;
using System.ServiceModel.Channels;
using System.ServiceModel.Security;
using System.ServiceModel.Web;
using System.Threading;
using System.Threading.Tasks;
using System.Web;
using DotNetOpenAuth.Messaging;
using DotNetOpenAuth.OAuth2;
using ProtocolException = System.ServiceModel.ProtocolException;

namespace WCFRescourcesServer.Code
{
    public class IdefavAuthorizationManager : ServiceAuthorizationManager
    {
        public IdefavAuthorizationManager()
        {
        }

        protected override bool CheckAccessCore(OperationContext operationContext)
        {
            if (!base.CheckAccessCore(operationContext))
            {
                return false;
            }

            var httpDetails = operationContext.RequestContext.RequestMessage.Properties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
            var requestUri = operationContext.RequestContext.RequestMessage.Properties.Via;

            return Task.Run(async delegate
            {
                ProtocolFaultResponseException exception = null;
                try
                {
                    var principal = await VerifyOAuth2Async(
                        httpDetails,
                        requestUri,
                        operationContext.IncomingMessageHeaders.Action ?? operationContext.IncomingMessageHeaders.To.AbsolutePath);
                    if (principal != null)
                    {
                        var policy = new OAuthPrincipalAuthorizationPolicy(principal);
                        var policies = new List<IAuthorizationPolicy> { policy };

                        var securityContext = new ServiceSecurityContext(policies.AsReadOnly());
                        if (operationContext.IncomingMessageProperties.Security != null)
                        {
                            operationContext.IncomingMessageProperties.Security.ServiceSecurityContext = securityContext;
                        }
                        else
                        {
                            operationContext.IncomingMessageProperties.Security = new SecurityMessageProperty
                            {
                                ServiceSecurityContext = securityContext,
                            };
                        }

                        securityContext.AuthorizationContext.Properties["Identities"] = new List<IIdentity> { principal.Identity, };

                        return true;
                    }
                    else
                    {
                        return false;
                    }
                }
                catch (ProtocolFaultResponseException ex)
                {

                    exception = ex;
                }
                catch (ProtocolException ex)
                {

                }

                if (exception != null)
                {
                    
                    // Return the appropriate unauthorized response to the client.
                    var outgoingResponse = await exception.CreateErrorResponseAsync(CancellationToken.None);
                    if (WebOperationContext.Current != null)
                        this.Respond(WebOperationContext.Current.OutgoingResponse, outgoingResponse);
                }

                return false;
            }).GetAwaiter().GetResult();
        }

        private static async Task<IPrincipal> VerifyOAuth2Async(HttpRequestMessageProperty httpDetails, Uri requestUri, params string[] requiredScopes)
        {
            var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer((RSACryptoServiceProvider)Common.Configuration.SigningCertificate.PublicKey.Key, (RSACryptoServiceProvider)Common.Configuration.EncryptionCertificate.PrivateKey));
            return await resourceServer.GetPrincipalAsync(httpDetails, requestUri, requiredScopes: requiredScopes);
        }

        private void Respond(OutgoingWebResponseContext responseContext, HttpResponseMessage responseMessage)
        {
            responseContext.StatusCode = responseMessage.StatusCode;
            responseContext.SuppressEntityBody = true;
            foreach (var header in responseMessage.Headers)
            {
                responseContext.Headers[header.Key] = header.Value.First();
            }
        }
    }
}

5、实现OAuthPrincipalAuthorizationPolicy接口

namespace OAuthResourceServer.Code {
    using System;
    using System.Collections.Generic;
    using System.IdentityModel.Claims;
    using System.IdentityModel.Policy;
    using System.Linq;
    using System.Security.Principal;
    using System.Web;

    public class OAuthPrincipalAuthorizationPolicy : IAuthorizationPolicy {
        private readonly Guid uniqueId = Guid.NewGuid();
        private readonly IPrincipal principal;

        /// <summary>
        /// Initializes a new instance of the <see cref="OAuthPrincipalAuthorizationPolicy"/> class.
        /// </summary>
        /// <param name="principal">The principal.</param>
        public OAuthPrincipalAuthorizationPolicy(IPrincipal principal) {
            this.principal = principal;
        }

        #region IAuthorizationComponent Members

        /// <summary>
        /// Gets a unique ID for this instance.
        /// </summary>
        public string Id {
            get { return this.uniqueId.ToString(); }
        }

        #endregion

        #region IAuthorizationPolicy Members

        public ClaimSet Issuer {
            get { return ClaimSet.System; }
        }

        public bool Evaluate(EvaluationContext evaluationContext, ref object state) {
            evaluationContext.AddClaimSet(this, new DefaultClaimSet(Claim.CreateNameClaim(this.principal.Identity.Name)));
            evaluationContext.Properties["Principal"] = this.principal;
            return true;
        }

        #endregion
    }
}

6、配置WCF

<system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="WSHttpBinding_OpenApi" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
          <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" />
          <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
          <security mode="Message">
            <transport clientCredentialType="Windows" proxyCredentialType="None" realm="" />
            <message clientCredentialType="Windows" negotiateServiceCredential="true" algorithmSuite="Default" />
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <behaviors>
      <endpointBehaviors>
        <behavior name="WCFRescourcesServer.OpenApiAspNetAjaxBehavior">
          <enableWebScript />
        </behavior>
        <behavior name="WCFRescourcesServer.Services1Behavior">
          
        </behavior>
      </endpointBehaviors>
      <serviceBehaviors>
        <behavior name="myS">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="false" />
          <serviceAuthorization serviceAuthorizationManagerType="WCFRescourcesServer.Code.IdefavAuthorizationManager, WCFRescourcesServer" principalPermissionMode="Custom" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
    <services>
      <service name="WCFRescourcesServer.Service1" behaviorConfiguration="myS">
        <endpoint address="" behaviorConfiguration="WCFRescourcesServer.Services1Behavior" binding="wsHttpBinding" contract="WCFRescourcesServer.IService1" />
      </service>
    </services>
  </system.serviceModel>

下面这段是关键的一句，配置WCF访问验证

<serviceAuthorization serviceAuthorizationManagerType="WCFRescourcesServer.Code.IdefavAuthorizationManager, WCFRescourcesServer" principalPermissionMode="Custom"/>

二、创建WCFClient访问WCF服务

创建一个IdefavOAuth2Client的Asp.net项目然后添加服务器引用

访问WCF代码如下：

protected async void Button1_Click(object sender, EventArgs e)
        {
            var authServer = new AuthorizationServerDescription()
            {
                
                TokenEndpoint = new Uri("http://localhost:53022/OAuth/token "),
                ProtocolVersion = ProtocolVersion.V20
            };
            //var wcf= new UserAgentClient(authServer, "idefav", "1");
            WebServerClient Client= new WebServerClient(authServer, "idefav", "1");

            var code =await Client.GetClientAccessTokenAsync(new string[] { "http://localhost:55044/IService1/DoWork" });
            string token = code.AccessToken;
            Service1Reference.Service1Client service1Client=new Service1Client();
            var httpRequest = (HttpWebRequest)WebRequest.Create(service1Client.Endpoint.Address.Uri);
            ClientBase.AuthorizeRequest(httpRequest,token);
            var httpDetails = new HttpRequestMessageProperty();
            httpDetails.Headers[HttpRequestHeader.Authorization] = httpRequest.Headers[HttpRequestHeader.Authorization];
            
            using (var scope = new OperationContextScope(service1Client.InnerChannel))
            {
                
                if (OperationContext.Current.OutgoingMessageProperties.ContainsKey(HttpRequestMessageProperty.Name))
                {
                    OperationContext.Current.OutgoingMessageProperties[HttpRequestMessageProperty.Name] = httpDetails;
                }
                else
                {
                    OperationContext.Current.OutgoingMessageProperties.Add(HttpRequestMessageProperty.Name, httpDetails);
                }
                
                Button1.Text= service1Client.DoWork();
            }


        }

注意：

标示的地方是可以从服务引用生成的代码上面看的到

当然这个Scope可以在WCF中配置

如果这里客户端和资源服务器不一致也会拒绝访问

我们来测试一下，把端口改成55045然后运行项目

结果：

最后，还有个注意点

DotNetOpenAuth v5.0.0-alpha3 从Nuget上面安装的有Bug，需要去github下载源代码然后编译成dll替换掉Nuget的dll

我已经编译好了一份，百度网盘：

链接：http://pan.baidu.com/s/1jGlMZye 密码：hw2o

这里的是WCF资源服务器以及客户端访问

下篇将会讲WebAPI形式的资源服务器