系列目录：
DotNetOpenAuth实践系列（源码在这里）
上一篇我们写了一个OAuth2的认证服务器，我们也获取到access_token，那么这个token怎么使用呢，我们现在就来揭开
一般获取access_token用处就是访问接口资源，不然也用不到怎么大费周章的还要获取个token再去访问资源
而接口有几类：
WCF服务接口，WebApi，还有自己用如ashx，aspx写的接口提供给前端调用的接口
其中WCF接口DotNetOpenAuth.Sample例子中已经做了
这些接口公开对外就需要一个认证的过程才能访问（当然内部或者内网使用的也不用这么麻烦，毕竟认证也是影响性能的）
废话不多说，我们下面开始搭建资源服务器
首先，搭建WCF服务接口的资源认证
一、创建WCF资源服务器项目
2、添加DotNetOpenAuth到项目中
3、添加WCF服务，为了方便，我们添加支持ajax的wcf服务
4、重写ServiceAuthorizationManager
using System;
using System.Collections.Generic;
using System.IdentityModel.Policy;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Security.Principal;
using System.ServiceModel;
using System.ServiceModel.Channels;
using System.ServiceModel.Security;
using System.ServiceModel.Web;
using System.Threading;
using System.Threading.Tasks;
using System.Web;
using DotNetOpenAuth.Messaging;
using DotNetOpenAuth.OAuth2;
using ProtocolException = System.ServiceModel.ProtocolException; namespace WCFRescourcesServer.Code
{
public class IdefavAuthorizationManager : ServiceAuthorizationManager
{
public IdefavAuthorizationManager()
{
} protected override bool CheckAccessCore(OperationContext operationContext)
{
if (!base.CheckAccessCore(operationContext))
{
return false;
} var httpDetails = operationContext.RequestContext.RequestMessage.Properties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
var requestUri = operationContext.RequestContext.RequestMessage.Properties.Via; return Task.Run(async delegate
{
ProtocolFaultResponseException exception = null;
try
{
var principal = await VerifyOAuth2Async(
httpDetails,
requestUri,
operationContext.IncomingMessageHeaders.Action ?? operationContext.IncomingMessageHeaders.To.AbsolutePath);
if (principal != null)
{
var policy = new OAuthPrincipalAuthorizationPolicy(principal);
var policies = new List<IAuthorizationPolicy> { policy }; var securityContext = new ServiceSecurityContext(policies.AsReadOnly());
if (operationContext.IncomingMessageProperties.Security != null)
{
operationContext.IncomingMessageProperties.Security.ServiceSecurityContext = securityContext;
}
else
{
operationContext.IncomingMessageProperties.Security = new SecurityMessageProperty
{
ServiceSecurityContext = securityContext,
};
} securityContext.AuthorizationContext.Properties["Identities"] = new List<IIdentity> { principal.Identity, }; return true;
}
else
{
return false;
}
}
catch (ProtocolFaultResponseException ex)
{ exception = ex;
}
catch (ProtocolException ex)
{ } if (exception != null)
{ // Return the appropriate unauthorized response to the client.
var outgoingResponse = await exception.CreateErrorResponseAsync(CancellationToken.None);
if (WebOperationContext.Current != null)
this.Respond(WebOperationContext.Current.OutgoingResponse, outgoingResponse);
} return false;
}).GetAwaiter().GetResult();
} private static async Task<IPrincipal> VerifyOAuth2Async(HttpRequestMessageProperty httpDetails, Uri requestUri, params string[] requiredScopes)
{
var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer((RSACryptoServiceProvider)Common.Configuration.SigningCertificate.PublicKey.Key, (RSACryptoServiceProvider)Common.Configuration.EncryptionCertificate.PrivateKey));
return await resourceServer.GetPrincipalAsync(httpDetails, requestUri, requiredScopes: requiredScopes);
} private void Respond(OutgoingWebResponseContext responseContext, HttpResponseMessage responseMessage)
{
responseContext.StatusCode = responseMessage.StatusCode;
responseContext.SuppressEntityBody = true;
foreach (var header in responseMessage.Headers)
{
responseContext.Headers[header.Key] = header.Value.First();
}
}
}
}
5、实现OAuthPrincipalAuthorizationPolicy接口
namespace OAuthResourceServer.Code {
using System;
using System.Collections.Generic;
using System.IdentityModel.Claims;
using System.IdentityModel.Policy;
using System.Linq;
using System.Security.Principal;
using System.Web;
public class OAuthPrincipalAuthorizationPolicy : IAuthorizationPolicy {
private readonly Guid uniqueId = Guid.NewGuid();
private readonly IPrincipal principal;
/// <summary>
/// Initializes a new instance of the <see cref="OAuthPrincipalAuthorizationPolicy"/> class.
/// </summary>
/// <param name="principal">The principal.</param>
public OAuthPrincipalAuthorizationPolicy(IPrincipal principal) {
this.principal = principal;
}
#region IAuthorizationComponent Members
/// <summary>
/// Gets a unique ID for this instance.
/// </summary>
public string Id {
get { return this.uniqueId.ToString(); }
}
#endregion
#region IAuthorizationPolicy Members
public ClaimSet Issuer {
get { return ClaimSet.System; }
}
public bool Evaluate(EvaluationContext evaluationContext, ref object state) {
evaluationContext.AddClaimSet(this, new DefaultClaimSet(Claim.CreateNameClaim(this.principal.Identity.Name)));
evaluationContext.Properties["Principal"] = this.principal;
return true;
}
#endregion
}
}6、配置WCF
<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_OpenApi" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="" maxReceivedMessageSize="" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
<readerQuotas maxDepth="" maxStringContentLength="" maxArrayLength="" maxBytesPerRead="" maxNameTableCharCount="" />
<reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
<security mode="Message">
<transport clientCredentialType="Windows" proxyCredentialType="None" realm="" />
<message clientCredentialType="Windows" negotiateServiceCredential="true" algorithmSuite="Default" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<endpointBehaviors>
<behavior name="WCFRescourcesServer.OpenApiAspNetAjaxBehavior">
<enableWebScript />
</behavior>
<behavior name="WCFRescourcesServer.Services1Behavior"> </behavior>
</endpointBehaviors>
<serviceBehaviors>
<behavior name="myS">
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="false" />
<serviceAuthorization serviceAuthorizationManagerType="WCFRescourcesServer.Code.IdefavAuthorizationManager, WCFRescourcesServer" principalPermissionMode="Custom" />
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
<services>
<service name="WCFRescourcesServer.Service1" behaviorConfiguration="myS">
<endpoint address="" behaviorConfiguration="WCFRescourcesServer.Services1Behavior" binding="wsHttpBinding" contract="WCFRescourcesServer.IService1" />
</service>
</services>
</system.serviceModel>
下面这段是关键的一句，配置WCF访问验证
<serviceAuthorization serviceAuthorizationManagerType="WCFRescourcesServer.Code.IdefavAuthorizationManager, WCFRescourcesServer" principalPermissionMode="Custom"/>
二、创建WCFClient访问WCF服务
创建一个IdefavOAuth2Client的Asp.net项目然后添加服务器引用
访问WCF代码如下：
protected async void Button1_Click(object sender, EventArgs e)
{
var authServer = new AuthorizationServerDescription()
{ TokenEndpoint = new Uri("http://localhost:53022/OAuth/token "),
ProtocolVersion = ProtocolVersion.V20
};
//var wcf= new UserAgentClient(authServer, "idefav", "1");
WebServerClient Client= new WebServerClient(authServer, "idefav", ""); var code =await Client.GetClientAccessTokenAsync(new string[] { "http://localhost:55044/IService1/DoWork" });
string token = code.AccessToken;
Service1Reference.Service1Client service1Client=new Service1Client();
var httpRequest = (HttpWebRequest)WebRequest.Create(service1Client.Endpoint.Address.Uri);
ClientBase.AuthorizeRequest(httpRequest,token);
var httpDetails = new HttpRequestMessageProperty();
httpDetails.Headers[HttpRequestHeader.Authorization] = httpRequest.Headers[HttpRequestHeader.Authorization]; using (var scope = new OperationContextScope(service1Client.InnerChannel))
{ if (OperationContext.Current.OutgoingMessageProperties.ContainsKey(HttpRequestMessageProperty.Name))
{
OperationContext.Current.OutgoingMessageProperties[HttpRequestMessageProperty.Name] = httpDetails;
}
else
{
OperationContext.Current.OutgoingMessageProperties.Add(HttpRequestMessageProperty.Name, httpDetails);
} Button1.Text= service1Client.DoWork();
} }
注意：
标示的地方是可以从服务引用生成的代码上面看的到
当然这个Scope可以在WCF中配置
如果这里客户端和资源服务器不一致也会拒绝访问
我们来测试一下，把端口改成55045然后运行项目
结果：
最后，还有个注意点
DotNetOpenAuth v5.0.0-alpha3 从Nuget上面安装的有Bug，需要去github下载源代码然后编译成dll替换掉Nuget的dll
我已经编译好了一份，百度网盘：
链接：http://pan.baidu.com/s/1jGlMZye 密码：hw2o
这里的是WCF资源服务器以及客户端访问
下篇将会讲WebAPI形式的资源服务器