Question

我的全球倡议应用程序使用WCFNet NamedPipeBled控制其姐妹Windows Service。我想防止其他申请冒用我的全球倡议申请和控制我的工作。

Is it necessary to authenticate the GUI application to the Windows Service to prevent impersonation?
And how should I go about it?

<><>Edit>: 远程计算机也应当能够控制这一服务,因为其认证(由服务机构委托),因此,我需要添加一个<代码>NetTcpBled。任何包含这一点的答案都会有所帮助。

Answer 1

是的,有必要确保世界家庭论坛的渠道,以防止冒犯。当你指示你时,妇女论坛可以自动加密你的来文,但你需要处理认证部分。

There are two methods of securing messages in WCF (three if you count the fact that you can use both of them at once). There is a good high level explanation here. Which of these methods you can use is dependent on which binding we are talking about (you will have different options for different bindings).

此外,对于确保服务的每一方法,你将选择认证标准类型(每个实体将其身份证明到另一端的实际手段)。 这取决于约束力,也取决于安全方法。

为了了解你对每一项具有约束力的选择,你可以检查其<代码>安全财产。每一约束性(例如NetTcp Security);你可以检查MSDN或IntelSense,以发现这一点。

我将使用<代码>NetTcpBled,从现在起,运输安全就是一个例子。

为了在服务器和客户部分建立安全,你首先必须在建立和开放这一渠道之前,将约束力与安保模式和认证类型混为一谈。

var binding = new NetTcpBinding { /* set props here */ };
// TLS security with X.509 certificates
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Certificate;

然后,在服务器方面(这一例子具体针对上述选择):

// Load and set the server certificate
var serverCertificate = new X509Certificate2(/* parameters here */);
host.Credentials.ServiceCertificate.Certificate = serverCertificate;

// You can leave it at that and let Windows validate the client s certificate using
// the default method (which means that you either need to have added the client s
// certificate to the server machine s certificate store as "trusted", or rely on chain
// trust and have the client s certificate signed by a trusted authority.

// Or, you can use custom validation rules:
var authentication = host.Credentials.ClientCertificate.Authentication;
authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
authentication.CustomCertificateValidator = new AcceptAnythingCertificateValidator();

在客户方面(这一例子也是具体的):

var clientCertificate = new X509Certificate2(/* parameters here */);
var factory = new ChannelFactory<IYourServiceInterface>(binding, endpoint);
factory.Credentials.ClientCertificate.Certificate = clientCertificate;

// You can leave it at that and let Windows validate the server s certificate using
// the default method (which means that you either need to have added the server s
// certificate to the client machine s certificate store as "trusted", or rely on chain
// trust and have the server s certificate signed by a trusted authority.

// Or, you can use custom validation rules:
var authentication = factory.Credentials.ServiceCertificate.Authentication;
authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
authentication.CustomCertificateValidator = new AcceptAnythingCertificateValidator();

var channel = factory.CreateChannel();

// Your channel is now ready for use! You can also cast to to IClientChannel
// to expose some more properties.

友情链接