为什么 IIS 中的授权规则不限制对我的 WCF 服务的访问？

Question

我在 IIS 10 中托管了一个独立的 WCF 服务。我想将对 Web 服务的访问限制为 select 组用户。通过在 IIS 中执行以下操作，我能够为 Web 应用程序执行此操作：

身份验证：Windows仅身份验证（禁用匿名身份验证）
授权规则：允许预定义组（即角色）

但是，当我为 Web 服务执行上述步骤并更改其 web.config 中的 clientCredentialType="Windows" 时，它仍然允许域中的任何用户与其交谈。我错过了一些明显的东西吗？在配置授权方面，Web 服务的功能是否与 Web 应用程序不同？根据我的设置，我希望只有 MyTestGroup 中的用户能够与 Web 服务对话，而所有其他用户都会收到 401 - Unauthorized.

顺便说一句，我尝试设置“拒绝所有人”规则，但域用户仍然可以与网络服务对话，所以我觉得授权设置没有以某种方式生效。寻找对此的任何见解。

相关web.config内容如下：

  <system.serviceModel>
    <services>
      <service name="StudyManagement.StudyManagement">
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="secureHttpBinding" name="StudyManagement" contract="StudyManagement.IStudyManagement" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
    <bindings>
      <basicHttpBinding>
        <binding maxReceivedMessageSize="1048576" />
        <binding name="secureHttpBinding">
          <security mode="Transport">
            <transport clientCredentialType="Windows" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="false" minFreeMemoryPercentageToActivateService="0" />
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
    <directoryBrowse enabled="false" />
        <security>
            <authorization>
                <remove users="*" roles="" verbs="" />
                <add accessType="Allow" users="" roles="MyAllowGroup" />
            </authorization>
        </security>
  </system.webServer>

Answer 1

可以参考这个website to re-create the authorization rules. In addition, the authorization of wcf services can use ServiceAuthenticationmanager, examples and tutorials.

Answer 2

以下 Microsoft 文档帮助回答了我的问题：

WCF services and ASP.NET

重要要点：

The ASP.NET HTTP runtime handles ASP.NET requests but does not participate in the processing of requests destined for WCF services, even though these services are hosted in the same AppDomain as is the ASP.NET content. Instead, the WCF Service Model intercepts messages addressed to WCF services and routes them through the WCF transport/channel stack.

Within an AppDomain, features implemented by the HTTP runtime apply to ASP.NET content but not to WCF. Many HTTP-specific features of the ASP.NET application platform do not apply to WCF Services hosted inside of an AppDomain that contains ASP.NET content. Examples of these features include the following:

File-based authorization: The WCF security model does not allow for the access control list (ACL) applied to the .svc file of the service when deciding if a service request is authorized.

Configuration-based URL Authorization: Similarly, the WCF security model does not adhere to any URL-based authorization rules specified in System.Web’s configuration element. These settings are ignored for WCF requests if a service resides in a URL space secured by ASP.NET’s URL authorization rules.

解决方案：

通过配置 web.config:

使用 ASP.NET 兼容模式

<system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
</system.serviceModel>

Unlike the default side-by-side configuration, where the WCF hosting infrastructure intercepts WCF messages and routes them out of the HTTP pipeline, WCF services running in ASP.NET Compatibility Mode participate fully in the ASP.NET HTTP request lifecycle. In compatibility mode, WCF services use the HTTP pipeline through an IHttpHandler implementation, similar to the way requests for ASPX pages and ASMX Web services are handled. As a result, WCF behaves identically to ASMX with respect to the following ASP.NET features:

File-based authorization: WCF services running in ASP.NET compatibility mode can be secure by attaching file system access control lists (ACLs) to the service’s .svc file.

Configurable URL authorization: ASP.NET’s URL authorization rules are enforced for WCF requests when the WCF service is running in ASP.NET Compatibility Mode.

我建议阅读整篇文章以获取更多信息。这是一篇简短而有用的读物。

感谢@Shiraz Bhaiji 在 WCF Authorization using IIS and ACLs 上的文章参考。

为什么 IIS 中的授权规则不限制对我的 WCF 服务的访问？

Why won't Authorization Rules in IIS restrict access to my WCF service?

wcf

authorization

web-config

windows-authentication

iis-10

解决方案：