使用 AzMan 角色提供程序实施 IIS 托管 WCF 服务

Question

我尝试实现一个托管在 IIS 上的 WCF 服务，用户要求进行一些模板文件转换，然后 return 他们得到处理过的文件（如果他们被授权使用他们要求的模板）。
我选择了 visual studio 项目模板 "WCF Service Application" 并获得了一个将 aspNetCompatibilityEnabled 设置为 true 等的项目。
我考虑使用 AzMan 授权来实现我的需求，因为我熟悉该机制并用它做了类似的事情。
但是，我无法调试该服务，因为我得到 401 未经授权。我假设没有发送用户令牌。

1.如何为 WCF、IIS 托管服务启用 Azman？
2. WCF 中是否有类似的机制可以帮助检查用户是否属于允许访问某些站点文件夹的组？

配置：

<configuration>
   <connectionStrings>
      <add name="LocalPolicyStore"connectionString="msxml://c:/RolesData/azmanstore.xml" />             </connectionStrings>
   <appSettings>
      <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  </appSettings>
<system.web>
   <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5"/>
    <authentication mode="Windows" />
    <authorization>
       <deny users="?" />
     </authorization>
     <roleManager enabled="true" cacheRolesInCookie="true" defaultProvider="RoleManagerAzManProvider" cookieName=".ASPXROLES" cookiePath="/" cookieTimeout="30" cookieRequireSSL="true" cookieSlidingExpiration="true" createPersistentCookie="false" cookieProtection="All">
   <providers>
    <add name="RoleManagerAzManProvider" type="System.Web.Security.AuthorizationStoreRoleProvider, System.Web, Version=4.0.0.0, Culture=neutral, publicKeyToken=b03f5f7f11d50a3a" connectionStringName="LocalPolicyStore" applicationName="DRP" />
  </providers>
 </roleManager>
</system.web>
<system.serviceModel>
<behaviors>
  <serviceBehaviors>
    <behavior name="metadataBehavior">
      <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
      <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"  />
      <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
      <serviceDebug includeExceptionDetailInFaults="false"/>

      <serviceAuthorization principalPermissionMode="UseAspNetRoles" 
                      roleProviderName="RoleManagerAzManProvider" />
    </behavior>
  </serviceBehaviors>
</behaviors>
<services>
  <service name="ExcelGeneratingService.ExcelGeneratorService" behaviorConfiguration="metadataBehavior">
    <endpoint
      address=""  
      binding="basicHttpBinding" bindingConfiguration="excelGeneratorServiceBinding"
      contract="ExcelGeneratingService.IExcelGeneratorService"/>
    <endpoint
        address="mex"
        binding="mexHttpBinding"
        contract="IMetadataExchange"/>
  </service>
</services>
 <bindings>
  <basicHttpBinding>
      <binding name="excelGeneratorServiceBinding">
          <security mode="TransportCredentialOnly">
              <transport clientCredentialType="Windows" />
          </security>
      </binding>
  </basicHttpBinding>
 </bindings>
<protocolMapping>
    <add binding="basicHttpsBinding" scheme="https" />
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true"   multipleSiteBindingsEnabled="true" />
 </system.serviceModel>
 <system.webServer>
 <modules runAllManagedModulesForAllRequests="true"/>
  <!--
      To browse web app root directory during debugging, set the value below to true.
    Set to false before deployment to avoid disclosing web app folder information.
  -->
<directoryBrowse enabled="true"/>
</system.webServer>

 </configuration>

代码：

     //Check if the user is allowed to access this path
     if (!UrlAuthorizationModule.CheckUrlAccessForPrincipal(virtPath, user, "GET"))
        {
            return false;
        }

Answer 1

我已经解决了。我希望它能帮助别人。

配置的一些修复（已附）。允许所有用户但在较低级别的文件夹中过滤。
正在 OS 上的 IIS 安装缺少的授权处理程序（打开 windows 功能...）
使用本地 IIS 而不是来自 visual studio
如果 IIS 虚拟文件夹创建失败，请清除用户数据文件夹 (C:\Users\\Documents\IISExpress\config) 中的 IIS Express 配置
为服务应用程序池用户（来自 IIS）为我的 azman 商店提供 reader 安全权限（在 azman 控制台）。

配置：

   <?xml version="1.0" encoding="UTF-8"?>
   <configuration>
      <connectionStrings>
         <add name="LocalPolicyStore" connectionString="msxml://c:/RolesData/ExcelGeneration.xml" />
          </connectionStrings>
          <appSettings>
             <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
          </appSettings>
       <system.web>
       <compilation debug="true" targetFramework="4.5" />
       <httpRuntime targetFramework="4.5" />
       <authentication mode="Windows" />
       <authorization>
          <allow users="*" />
       </authorization>
       <identity impersonate="false" />
       <roleManager enabled="true" cacheRolesInCookie="true" defaultProvider="RoleManagerAzManProvider" cookieName=".ASPXROLES" cookiePath="/" cookieTimeout="30" cookieRequireSSL="true" cookieSlidingExpiration="true" createPersistentCookie="false" cookieProtection="All">
         <providers>
           <add name="RoleManagerAzManProvider" type="System.Web.Security.AuthorizationStoreRoleProvider, System.Web, Version=4.0.0.0, Culture=neutral, publicKeyToken=b03f5f7f11d50a3a" connectionStringName="LocalPolicyStore" applicationName="ExcelGeneration" />
         </providers>
      </roleManager>
    </system.web>
 <system.serviceModel>
    <behaviors>
       <serviceBehaviors>
           <behavior name="metadataBehavior">
               <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
               <serviceDebug includeExceptionDetailInFaults="true" />
               <serviceAuthorization principalPermissionMode="UseAspNetRoles"
        roleProviderName="RoleManagerAzManProvider" />
          </behavior>
  </serviceBehaviors>
</behaviors>
<services>
  <service name="ExcelGeneratingService.ExcelGeneratorService" behaviorConfiguration="metadataBehavior">
    <endpoint address="" bindingConfiguration="excelGeneratorServiceBinding" binding="basicHttpBinding" contract="ExcelGeneratingService.IExcelGeneratorService">
      <identity>
        <dns value="localhost" />
      </identity>
    </endpoint>
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
  </service>
</services>
<bindings>
  <basicHttpBinding>
      <binding name="excelGeneratorServiceBinding">
          <security mode="TransportCredentialOnly">
              <transport clientCredentialType="Windows" />
          </security>
      </binding>
  </basicHttpBinding>
</bindings>

   <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
   <serviceHostingEnvironment aspNetCompatibilityEnabled="true"  multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
  <system.webServer>
      <modules runAllManagedModulesForAllRequests="true" />
      <!--
          To browse web app root directory during debugging, set the value  below to true.
    Set to false before deployment to avoid disclosing web app folder information.
       -->
     <directoryBrowse enabled="true" />
   </system.webServer>

使用 AzMan 角色提供程序实施 IIS 托管 WCF 服务

Implemeneting IIS hosted WCF service with AzMan role provider

asp.net

iis

wcf

authorization

web-services