使用OAuth方式保护你的WCF Service(通过Azure ACS)
大家好，今天我们来分享一下在Windows Azure平台上如何保护你部署的WCF Service。
之前我有过一篇文章介绍Azure的Access Control Service（http://blog.csdn.net/aa466564931/article/details/7546415）, 这里我们将要介绍如何来使用他保护部署在Azure云计算平台上面的应用程序或者是对外的Service。
在开始介绍之前，先来说明一下我们这里使用的ACS OAuth方式，这里我们用到的是ACS的Service Identities，并且使用Service Identities的密码作为访问WCF service的凭据，客户端只有通过验证（这里将会生成一个基于此密码的OAuth令牌，令牌含有用户名，创建时间，过期时间，验证的唯一标识等信息）才能够访问到我们部署好的service，提供了一种较为安全的方式。
好了，下面开始如何创建这样一个service，当然我们必须要有的Azure的账号（可以申请免费试用的账号），现在Azure还没有在中国正式release，所以注册稍微会麻烦一些，需要一个境外的电话和用于支付的信用卡（信用卡无需是境外的），你可以提供一个香港的电话或者联系微软的support来完成注册。
拥有账号之后请访问（windows.azure.com）访问Azure的管理页面，在这里我们可以部署自己的application, service，提供证书，使用各种服务和功能等等。具体的大家可以边看边试试。这里我们点击“服务总线，访问控制和缓存”按钮，点击访问控制（Access Control）,并且创建一个访问控制的命名空间（如果已经创建好了，跳过这一步），最后单击工具栏的访问控制跳转到ACS的配置页面。
在左边的panel中选择Service Identities, 点击添加来创建一个新的indentity，按照描述信息依次键入名称，描述信息。在类型这一栏，我们选择密码方式作为我们的验证的credential, 并且输入你想设置的密码，完了设置有效时期和过期时间，点击保存按钮。这样你在ACS上的配置工作就完成了。
下面我们来做具体的代码编写工作，首先我们创建一个WCF Service，这个service将被ACS保护，并且通过验证才能访问它，为了简便我们这里仅仅创建几个简单的方法，例如获取用户的个人信息，添加新用户等方法，下面贴一段给大家看看，interface和User类的定义就不列举了，非常简单，大家可以通过下载完整sample来看更详细的信息。
[本示例完整源码下载(0分)]http://download.csdn.net/detail/aa466564931/4455947
UserService.cs
public class UserService : IUserService { List<User> users = new List<User>(); /// <summary> /// Add default users. /// </summary> public UserService() { User user = new User(); user.UserId = "1"; user.FirstName = "Jim"; user.LastName = "James"; User user2 = new User(); user2.UserId = "2"; user2.FirstName = "Nancy"; user2.LastName = "Wang"; users.Add(user); users.Add(user2); } /// <summary> /// Return all users. /// </summary> /// <returns></returns> public List<User> GetAllUsers() { return users; } /// <summary> /// Add a new user in user list. /// </summary> /// <param name="u"></param> /// <returns></returns> public bool AddNewUser(User u) { if (!users.Exists(e => e.UserId == u.UserId)) { users.Add(u); return true; } else { return false; } } /// <summary> /// Get user info by id. /// </summary> /// <param name="userId"></param> /// <returns></returns> public User GetUser(string userId) { if (users.Exists(e => e.UserId == userId)) { return users.Find(f => f.UserId == userId); } else { User user = new User(); user.UserId = ""; return user; } } }
OK, Service创建完成了，你可以把它部署到ACS或者是其他Server。下面我们来创建一个安全模块来保护这个Service，这个模块有两个类，一个为SWTModule.cs，他用于设置SWT类型令牌的信任关系，这里需要你吧刚刚在Azure ACS管理页面上设置信息写入了，例如ACS的命名空间，你的密码和acs路径。他是继承与IHttpModule接口的，也就是说在调用Service之前，你需要通过这个HttpModule的验证。另外一个类时TokenValidator，如字面意思，这个类用来检查你的Token的正确性，包括检查你的Token的名字，信任的key，过期时间，SHA-256加密等等. 这两个类是验证功能的核心部分。
SWTMoudle.cs:
class SWTMoudle : IHttpModule { string serviceNamespace = "<Your ACS namespace>"; string acsHostName = "accesscontrol.windows.net"; // Certificate and keys string trustedTokenPolicyKey = "<Your Signing certificate symmetric key>"; // Service Realm string trustedAudience = "<Your ACS service path>"; void IHttpModule.Dispose() { } void IHttpModule.Init(HttpApplication context) { context.BeginRequest += new EventHandler(context_BeginRequest); } void context_BeginRequest(object sender, EventArgs e) { if (HttpContext.Current.Request.Url.AbsolutePath.EndsWith(".svc")) { // Get the authorization header string headerValue = HttpContext.Current.Request.Headers.Get("Authorization"); // Check that a value is there if (string.IsNullOrEmpty(headerValue)) { throw new ApplicationException("unauthorized"); } // Check that it starts with 'WRAP' if (!headerValue.StartsWith("WRAP ")) { throw new ApplicationException("unauthorized"); } string[] nameValuePair = headerValue.Substring("WRAP ".Length).Split(new char[] { '=' }, 2); if (nameValuePair.Length != 2 || nameValuePair[0] != "access_token" || !nameValuePair[1].StartsWith("\"") || !nameValuePair[1].EndsWith("\"")) { throw new ApplicationException("unauthorized"); } // Trim off the leading and trailing double-quotes string token = nameValuePair[1].Substring(1, nameValuePair[1].Length - 2); // Create a token validate TokenValidator validator = new TokenValidator( this.acsHostName, this.serviceNamespace, this.trustedAudience, this.trustedTokenPolicyKey); // Validate the token if (!validator.Validate(token)) { throw new ApplicationException("unauthorized"); } } } }
TokenValidator.cs
public class TokenValidator { private string issuerLabel = "Issuer"; private string expiresLabel = "ExpiresOn"; private string audienceLabel = "Audience"; private string hmacSHA256Label = "HMACSHA256"; private string acsHostName; private string trustedSigningKey; private string trustedTokenIssuer; private string trustedAudienceValue; /// <summary> /// Token validate constructor method. /// </summary> /// <param name="acsHostName"></param> /// <param name="serviceNamespace"></param> /// <param name="trustedAudienceValue"></param> /// <param name="trustedSigningKey"></param> public TokenValidator(string acsHostName, string serviceNamespace, string trustedAudienceValue, string trustedSigningKey) { this.trustedSigningKey = trustedSigningKey; this.trustedTokenIssuer = String.Format("https://{0}.{1}/", serviceNamespace.ToLowerInvariant(), acsHostName.ToLowerInvariant()); this.trustedAudienceValue = trustedAudienceValue; } public bool Validate(string token) { if (!this.IsHMACValid(token, Convert.FromBase64String(this.trustedSigningKey))) { return false; } if (this.IsExpired(token)) { return false; } if (!this.IsIssuerTrusted(token)) { return false; } if (!this.IsAudienceTrusted(token)) { return false; } return true; } public Dictionary<string, string> GetNameValues(string token) { if (string.IsNullOrEmpty(token)) { throw new ArgumentException(); } return token .Split('&') .Aggregate( new Dictionary<string, string>(), (dict, rawNameValue) => { if (rawNameValue == string.Empty) { return dict; } string[] nameValue = rawNameValue.Split('='); if (nameValue.Length != 2) { throw new ArgumentException("Invalid formEncodedstring - contains a name/value pair missing an = character"); } if (dict.ContainsKey(nameValue[0]) == true) { throw new ArgumentException("Repeated name/value pair in form"); } dict.Add(HttpUtility.UrlDecode(nameValue[0]), HttpUtility.UrlDecode(nameValue[1])); return dict; }); } private static ulong GenerateTimeStamp() { // Default implementation of epoch time TimeSpan ts = DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, 0); return Convert.ToUInt64(ts.TotalSeconds); } private bool IsAudienceTrusted(string token) { Dictionary<string, string> tokenValues = this.GetNameValues(token); string audienceValue; tokenValues.TryGetValue(this.audienceLabel, out audienceValue); if (!string.IsNullOrEmpty(audienceValue)) { if (audienceValue.Equals(this.trustedAudienceValue, StringComparison.Ordinal)) { return true; } } return false; } private bool IsIssuerTrusted(string token) { Dictionary<string, string> tokenValues = this.GetNameValues(token); string issuerName; tokenValues.TryGetValue(this.issuerLabel, out issuerName); if (!string.IsNullOrEmpty(issuerName)) { if (issuerName.Equals(this.trustedTokenIssuer)) { return true; } } return false; } private bool IsHMACValid(string swt, byte[] sha256HMACKey) { string[] swtWithSignature = swt.Split(new string[] { "&" + this.hmacSHA256Label + "=" }, StringSplitOptions.None); if ((swtWithSignature == null) || (swtWithSignature.Length != 2)) { return false; } HMACSHA256 hmac = new HMACSHA256(sha256HMACKey); byte[] locallyGeneratedSignatureInBytes = hmac.ComputeHash(Encoding.ASCII.GetBytes(swtWithSignature[0])); string locallyGeneratedSignature = HttpUtility.UrlEncode(Convert.ToBase64String(locallyGeneratedSignatureInBytes)); return locallyGeneratedSignature == swtWithSignature[1]; } private bool IsExpired(string swt) { try { Dictionary<string, string> nameValues = this.GetNameValues(swt); string expiresOnValue = nameValues[this.expiresLabel]; ulong expiresOn = Convert.ToUInt64(expiresOnValue); ulong currentTime = Convert.ToUInt64(GenerateTimeStamp()); if (currentTime > expiresOn) { return true; } return false; } catch (KeyNotFoundException) { throw new ArgumentException(); } } }
好，创建完Security这块功能之后呢，现在我们要做的就是访问这个service了，这里仅仅为了测试，所以我会把Token的输出出来看看，如果实际运用的话则不能列出来了，因为Token还是包含了很多用户的信息的。
创建一个Silverlight客户端，添加一些基本的控件在MainPage.xaml上：
<Grid x:Name="LayoutRoot" Background="White"> <Grid.RowDefinitions > <RowDefinition Height="100"></RowDefinition> <RowDefinition Height="60"></RowDefinition> <RowDefinition Height="*"></RowDefinition> </Grid.RowDefinitions> <Button Content="Click for Token" Height="23" Grid.Row="1" HorizontalAlignment="Left" Name="btnLogin" VerticalAlignment="Top" Width="153" Click="btnToken_Click" /> <TextBox Grid.Row="0" Name="tbToken" HorizontalScrollBarVisibility="Visible" IsReadOnly="True" /> <Button Content="Click for Data" Height="23" HorizontalAlignment="Left" Margin="170,0,0,0" Name="btnData" VerticalAlignment="Top" Width="153" Grid.Row="1" Click="btnData_Click" /> <sdk:Label Grid.Row="1" Height="28" HorizontalAlignment="Left" Margin="1,29,0,0" Name="lbContent" VerticalAlignment="Top" Width="120" /> <sdk:DataGrid AutoGenerateColumns="True" Grid.Row="2" HorizontalAlignment="Left" Name="dtgContent" VerticalAlignment="Top" /> </Grid>
下面的后台代码，调用Service方需要输入你需要访问ACS的地址以及密码等信息：
MainPage.xaml.cs
public partial class MainPage : UserControl { /// <summary> /// Necessary variables from ACS Portal. /// </summary> const string serviceNamespace = "<Your ACS namespace>"; const string acsHostUrl = "accesscontrol.windows.net"; const string realm = "<Your ACS service path>"; const string userUrl = "<The user service path>"; const string uid = "<Your service identity name>"; const string pwd = "<Your service identity password>"; string variables; string tokenString; public MainPage() { InitializeComponent(); } /// <summary> /// Get Token from ACS. /// </summary> /// <param name="sender"></param> /// <param name="e"></param> private void btnToken_Click(object sender, RoutedEventArgs e) { string token = GetTokenFromACS(realm); } /// <summary> /// Access WCF service. /// </summary> /// <param name="sender"></param> /// <param name="e"></param> private void btnData_Click(object sender, RoutedEventArgs e) { if (!tbToken.Text.Trim().Equals(string.Empty)) { HttpWebRequest request = HttpWebRequest.Create(userUrl) as HttpWebRequest; string headerValue = string.Format("WRAP access_token=\"{0}\"", tokenString); request.Method = "GET"; request.Headers["Authorization"] = headerValue; AsyncCallback callBack = new AsyncCallback(LoginGetResponse); request.BeginGetResponse(callBack, request); } else { lbContent.Content = "Please get token first."; } } /// <summary> /// Display data from WCF service. /// </summary> /// <param name="result"></param> public void LoginGetResponse(IAsyncResult result) { HttpWebRequest request = result.AsyncState as HttpWebRequest; HttpWebResponse response = request.EndGetResponse(result) as HttpWebResponse; string obj = string.Empty; using (StreamReader reader = new StreamReader(response.GetResponseStream())) { obj = reader.ReadToEnd(); } XDocument document = XDocument.Parse(obj); var list = from d in document.Descendants("User") select new User { UserId = d.Element("UserId").Value, FirstName = d.Element("FirstName").Value, LastName = d.Element("LastName").Value }; ObservableCollection<User> collection = new ObservableCollection<User>(); foreach (User user in list) { collection.Add(user); } Dispatcher.BeginInvoke(() => { dtgContent.ItemsSource = collection; }); } /// <summary> /// Get Token from ACS portal. /// </summary> /// <param name="scope"></param> /// <returns></returns> private string GetTokenFromACS(string scope) { string wrapPassword = pwd; string wrapUsername = uid; // request a token from ACS string address = string.Format("https://{0}.{1}/WRAPv0.9", serviceNamespace, acsHostUrl); HttpWebRequest requestToken = (HttpWebRequest)HttpWebRequest.Create(address); variables = string.Format("{0}={1}&{2}={3}&{4}={5}", "wrap_name", wrapUsername, "wrap_password", wrapPassword, "wrap_scope", scope); requestToken.Method = "POST"; AsyncCallback callBack = new AsyncCallback(EndGetRequestStream); requestToken.BeginGetRequestStream(callBack, requestToken); return tokenString; } public void EndGetRequestStream(IAsyncResult result) { HttpWebRequest requestToken = result.AsyncState as HttpWebRequest; Stream stream = requestToken.EndGetRequestStream(result); byte[] bytes = Encoding.UTF8.GetBytes(variables); stream.Write(bytes, 0, bytes.Length); stream.Close(); requestToken.BeginGetResponse(TokenEndReponse, requestToken); } public void TokenEndReponse(IAsyncResult result) { HttpWebRequest requestToken = result.AsyncState as HttpWebRequest; HttpWebResponse responseToken = requestToken.EndGetResponse(result) as HttpWebResponse; using(StreamReader reader = new StreamReader(responseToken.GetResponseStream())) { tokenString = reader.ReadToEnd(); } string resultString = HttpUtility.UrlDecode( tokenString .Split('&') .Single(value => value.StartsWith("wrap_access_token=", StringComparison.OrdinalIgnoreCase)) .Split('=')[1]); tokenString = resultString; Dispatcher.BeginInvoke(() => { tbToken.Text = resultString; }); } }
OK, 现在你可以通过启动Silverlight项目来调用Service了，先点击Click for Token 后点击Click for data.
我还创建一个控制台程序来调用它，效果是一样的：
class Program { /// <summary> /// Necessary variables from ACS Portal. /// </summary> static string serviceNamespace = "<Your ACS namespace>"; static string acsHostUrl = "accesscontrol.windows.net"; static string realm = "<Your ACS service path>"; static string userUrl = "<Your user service path>"; static string uid = "<Your service identity name>"; static string pwd = "<Your service identity password>"; /// <summary> /// Access the service via ACS Token. /// </summary> /// <param name="args"></param> static void Main(string[] args) { string token = GetTokenFromACS(realm); WebClient client = new WebClient(); string headerValue = string.Format("WRAP access_token=\"{0}\"", token); HttpWebRequest request = HttpWebRequest.Create(userUrl) as HttpWebRequest; request.ContentLength = 0; request.Method = "GET"; request.Headers["Authorization"] = headerValue; HttpWebResponse response = request.GetResponse() as HttpWebResponse; using (StreamReader reader = new StreamReader(response.GetResponseStream())) { string obj = reader.ReadToEnd(); Console.Write(obj); Console.ReadLine(); } } /// <summary> /// Get Token from ACS. /// </summary> /// <param name="scope"></param> /// <returns></returns> private static string GetTokenFromACS(string scope) { string wrapPassword = pwd; string wrapUsername = uid; // request a token from ACS WebClient client = new WebClient(); client.BaseAddress = string.Format("https://{0}.{1}", serviceNamespace, acsHostUrl); NameValueCollection values = new NameValueCollection(); values.Add("wrap_name", wrapUsername); values.Add("wrap_password", wrapPassword); values.Add("wrap_scope", scope); byte[] responseBytes = client.UploadValues("WRAPv0.9/", "POST", values); string response = Encoding.UTF8.GetString(responseBytes); Console.WriteLine("\nreceived token from ACS: {0}\n", response); return HttpUtility.UrlDecode( response .Split('&') .Single(value => value.StartsWith("wrap_access_token=", StringComparison.OrdinalIgnoreCase)) .Split('=')[1]); } }