HOW TO:使用 SOAP 標頭執行自訂驗證
本主題專門說明舊有技術。 應該使用下列建立 XML Web Service 及 XML Web Service 用戶端: Windows Communication Foundation.
下列自訂方案是使用 ASP.NET 所建置,以便使用 SOAP 標頭提供驗證機制。這個方案需要在執行下列步驟的 Web 伺服器上自訂 IHttpModule:
HTTP Module 剖析 HTTP 訊息以檢查是否為 SOAP 訊息。
如果 HTTP Module 偵測到 SOAP 訊息,就讀取 SOAP 標頭。
如果 SOAP 訊息含有夾帶驗證認證的 SOAP 標頭,HTTP Module 就引發自訂 global.asax 事件。
在提供的範例中,HTTP Module 會驗證使用者,並設定 Context 屬性,Web 服務可以使用這個屬性來判斷用戶端是否有權存取 Web 服務。
注意: |
---|
在這個範例中,會採用可辨讀的純文字格式,在網路傳送文字 (未經加密)。如果純文字對您的應用程式而言不夠安全,請新增加密演算法。 |
範例
下列程式碼範例是針對 SOAP 要求剖析其 HTTP 訊息的 HTTP 模組。如果 HTTP 訊息是 SOAP 訊息,將會引發自訂的 WebServiceAuthenticationEvent
。
using System;
using System.Web;
using System.IO;
using System.Xml;
using System.Xml.XPath;
using System.Text;
using System.Web.Services.Protocols;
namespace Microsoft.WebServices.Security {
public sealed class WebServiceAuthenticationModule : IHttpModule
{
private WebServiceAuthenticationEventHandler
_eventHandler = null;
public event WebServiceAuthenticationEventHandler Authenticate
{
add { _eventHandler += value;}
remove {_eventHandler -= value;}
}
public void Dispose()
{
}
public void Init(HttpApplication app)
{
app.AuthenticateRequest += new
EventHandler(this.OnEnter);
}
private void OnAuthenticate(WebServiceAuthenticationEvent e)
{
if (_eventHandler == null)
return;
_eventHandler(this, e);
if (e.User != null)
e.Context.User = e.Principal;
}
public string ModuleName
{
get{ return "WebServiceAuthentication"; }
}
void OnEnter(Object source, EventArgs eventArgs) {
HttpApplication app = (HttpApplication)source;
HttpContext context = app.Context;
Stream HttpStream = context.Request.InputStream;
// Save the current position of stream.
long posStream = HttpStream.Position;
// If the request contains an HTTP_SOAPACTION
// header, look at this message.
if (context.Request.ServerVariables["HTTP_SOAPACTION"]
== null)
return;
// Load the body of the HTTP message
// into an XML document.
XmlDocument dom = new XmlDocument();
string soapUser;
string soapPassword;
try
{
dom.Load(HttpStream);
// Reset the stream position.
HttpStream.Position = posStream;
// Bind to the Authentication header.
soapUser =
dom.GetElementsByTagName("User").Item(0).InnerText;
soapPassword =
dom.GetElementsByTagName("Password").Item(0).InnerText;
}
catch (Exception e)
{
// Reset the position of stream.
HttpStream.Position = posStream;
// Throw a SOAP exception.
XmlQualifiedName name = new
XmlQualifiedName("Load");
SoapException soapException = new SoapException(
"Unable to read SOAP request", name, e);
throw soapException;
}
// Raise the custom global.asax event.
OnAuthenticate(new WebServiceAuthenticationEvent (context, soapUser, soapPassword));
return;
}
}
}
Public NotInheritable Class WebServiceAuthenticationModule
Implements IHttpModule
Public Delegate Sub WebServiceAuthenticationEventHandler(ByVal sender As [Object], ByVal e As WebServiceAuthenticationEvent)
Private _eventHandler As WebServiceAuthenticationEventHandler = Nothing
Public Custom Event Authenticate As
WebServiceAuthenticationEventHandler
AddHandler(ByVal value As
WebServiceAuthenticationEventHandler)
_eventHandler = value
End AddHandler
RemoveHandler(ByVal value As
WebServiceAuthenticationEventHandler)
_eventHandler = value
End RemoveHandler
RaiseEvent(ByVal sender As Object,
ByVal e As WebServiceAuthenticationEvent)
End RaiseEvent
End Event
Public Sub Dispose() Implements System.Web.IHttpModule.Dispose
End Sub 'Dispose
Public Sub Init(ByVal app As HttpApplication) Implements System.Web.IHttpModule.Init
AddHandler app.AuthenticateRequest, AddressOf Me.OnEnter
End Sub 'Init
Private Sub OnAuthenticate(ByVal e As WebServiceAuthenticationEvent)
If _eventHandler Is Nothing Then
Return
End If
_eventHandler(Me, e)
If Not (e.User Is Nothing) Then
e.Context.User = e.Principal
End If
End Sub 'OnAuthenticate
Public ReadOnly Property ModuleName() As String
Get
Return "WebServiceAuthentication"
End Get
End Property
Sub OnEnter(ByVal [source] As [Object], ByVal eventArgs As EventArgs)
Dim app As HttpApplication = CType([source], HttpApplication)
Dim context As HttpContext = app.Context
Dim HttpStream As Stream = context.Request.InputStream
' Save the current position of stream.
Dim posStream As Long = HttpStream.Position
' If the request contains an HTTP_SOAPACTION
' header, look at this message.
If context.Request.ServerVariables("HTTP_SOAPACTION") Is Nothing Then
Return
End If
' Load the body of the HTTP message
' into an XML document.
Dim dom As New XmlDocument()
Dim soapUser As String
Dim soapPassword As String
Try
dom.Load(HttpStream)
' Reset the stream position.
HttpStream.Position = posStream
' Bind to the Authentication header.
soapUser = dom.GetElementsByTagName("User").Item(0).InnerText
soapPassword = dom.GetElementsByTagName("Password").Item(0).InnerText
Catch e As Exception
' Reset the position of stream.
HttpStream.Position = posStream
' Throw a SOAP exception.
Dim name As New XmlQualifiedName("Load")
Dim soapException As New SoapException("Unable to read SOAP request", name, e)
Throw soapException
End Try
' Raise the custom global.asax event.
OnAuthenticate(New WebServiceAuthenticationEvent(context, soapUser, soapPassword))
Return
End Sub 'OnEnter
End Class 'WebServiceAuthenticationModule
下列程式碼範例是 HTTP Module 在收到 SOAP 要求時引發的自訂驗證事件。
namespace Microsoft.WebServices.Security {
using System;
using System.Web;
using System.Security.Principal;
public class WebServiceAuthenticationEvent : EventArgs {
private Iprincipal _IPrincipalUser;
private HttpContext _Context;
private string _User;
private string _Password;
public WebServiceAuthenticationEvent(HttpContext context)
{
_Context = context;
}
public WebServiceAuthenticationEvent(HttpContext context,
string user, string password)
{
_Context = context;
_User = user;
_Password = password;
}
public HttpContext Context
{
get { return _Context;}
}
public IPrincipal Principal
{
get { return _IPrincipalUser;}
set { _IPrincipalUser = value;}
}
public void Authenticate()
{
GenericIdentity i = new GenericIdentity(User);
this.Principal = new GenericPrincipal(i, new String[0]);
}
public void Authenticate(string[] roles)
{
GenericIdentity i = new GenericIdentity(User);
this.Principal = new GenericPrincipal(i, roles);
}
public string User
{
get { return _User; }
set { _User = value; }
}
public string Password
{
get { return _Password; }
set { _Password = value; }
}
public bool HasCredentials {
get
{
if ((_User == null) || (_Password == null))
return false;
return true;
}
}
}
}
Imports System
Imports System.Web
Imports System.Security.Principal
Public Class WebServiceAuthenticationEvent
Inherits EventArgs
Private _IPrincipalUser As Iprincipal
Private _Context As HttpContext
Private _User As String
Private _Password As String
Public Sub New(ByVal context As HttpContext)
_Context = context
End Sub 'New
Public Sub New(ByVal context As HttpContext, ByVal user As String, ByVal password As String)
_Context = context
_User = user
_Password = password
End Sub 'New
Public ReadOnly Property Context() As HttpContext
Get
Return _Context
End Get
End Property
Public Property Principal() As IPrincipal
Get
Return _IPrincipalUser
End Get
Set
_IPrincipalUser = value
End Set
End Property
Overloads Public Sub Authenticate()
Dim i As New GenericIdentity(User)
Me.Principal = New GenericPrincipal(i, New String(-1) {})
End Sub 'Authenticate
Overloads Public Sub Authenticate(ByVal roles() As String)
Dim i As New GenericIdentity(User)
Me.Principal = New GenericPrincipal(i, roles)
End Sub 'Authenticate
Public Property User() As String
Get
Return _User
End Get
Set
_User = value
End Set
End Property
Public Property Password() As String
Get
Return _Password
End Get
Set
_Password = value
End Set
End Property
Public ReadOnly Property HasCredentials() As Boolean
Get
If _User Is Nothing OrElse _Password Is Nothing Then
Return False
End If
Return True
End Get
End Property
End Class 'WebServiceAuthenticationEvent
下列程式碼範例是自訂 WebServiceAuthenticationEvent
事件的委派。
namespace Microsoft.WebServices.Security
{
using System;
public delegate void WebServiceAuthenticationEventHandler(Object sender, WebServiceAuthenticationEvent e);
}
Imports System
Public Delegate Sub WebServiceAuthenticationEventHandler(ByVal sender As [Object], ByVal e As WebServiceAuthenticationEvent)
下列程式碼範例是一個 Web 服務,它會定義用戶端必須傳遞的 Authentication
SOAP 標頭。這個 Web 服務不需要執行驗證,而是可以檢查 User.Identity.IsAuthenticated 屬性來判斷 HTTP Module 是否驗證了使用者。
<%@ WebService Language="C#" Class="SecureWebService" %>
using System;
using System.Web.Services;
using System.Web.Services.Protocols;
public class Authentication : SoapHeader {
public string User;
public string Password;
}
public class SecureWebService : WebService{
public Authentication authentication;
[WebMethod]
[SoapHeader("authentication")]
public string ValidUser(){
if (User.IsInRole("Customer"))
return "User is in role customer";
if (User.Identity.IsAuthenticated)
return "User is a valid user";
return "not authenticated";
}
}
<%@ WebService Language="VB" Class="SecureWebService" %>
Imports System
Imports System.Web.Services
Imports System.Web.Services.Protocols
Public Class Authentication
Inherits SoapHeader
Public User As String
Public Password As String
End Class 'Authentication
Public Class SecureWebService
Inherits WebService
Public authentication As Authentication
<WebMethod(), SoapHeader("authentication")> _
Public Function ValidUser() As String
If User.IsInRole("Customer") Then
Return "User is in role customer"
End If
If User.Identity.IsAuthenticated Then
Return "User is a valid user"
End If
Return "not authenticated"
End Function 'ValidUser
End Class 'SecureWebService
下列程式碼範例是一個 Web 服務用戶端,它會在 Authentication
SOAP 標頭內傳遞必要的認證給自訂 SOAP 標頭驗證機制。
// Create a new instance of a Web service proxy class.
SecureWebService s = new SecureWebService();
// Create the Authentication SOAP header and set values.
Authentication a = new Authentication();
a.User = user.Value;
a.Password = password.Value;
// Assign the Header.
s.AuthenticationValue = a;
string result = s.ValidUser();
span1.InnerHtml = result;
' Create a new instance of a Web service proxy class.
Dim s As New SecureWebService()
' Create the Authentication SOAP header and set values.
Dim a As New Authentication()
a.User = user.Value
a.Password = password.Value
Assign the Header.
s.AuthenticationValue = a
Dim result As String = s.ValidUser()
span1.InnerHtml = result
另請參閱
工作
HOW TO:設定 XML Web Service 進行 Windows 驗證
參考
NetworkCredential
CredentialCache
X509Certificate
概念
為使用 ASP.NET 建立的 XML Web Service 設定安全性
其他資源
Securing ASP.NET Web Applications
使用 ASP.NET 的 XML Web Service