SslStreamSecurityBindingElement 类

定义

public ref class SslStreamSecurityBindingElement : System::ServiceModel::Channels::BindingElement

public ref class SslStreamSecurityBindingElement : System::ServiceModel::Channels::StreamUpgradeBindingElement

public ref class SslStreamSecurityBindingElement : System::ServiceModel::Channels::StreamUpgradeBindingElement, System::ServiceModel::Channels::ITransportTokenAssertionProvider, System::ServiceModel::Description::IPolicyExportExtension

public class SslStreamSecurityBindingElement : System.ServiceModel.Channels.BindingElement

public class SslStreamSecurityBindingElement : System.ServiceModel.Channels.StreamUpgradeBindingElement

public class SslStreamSecurityBindingElement : System.ServiceModel.Channels.StreamUpgradeBindingElement, System.ServiceModel.Channels.ITransportTokenAssertionProvider, System.ServiceModel.Description.IPolicyExportExtension

type SslStreamSecurityBindingElement = class
    inherit BindingElement

type SslStreamSecurityBindingElement = class
    inherit StreamUpgradeBindingElement

type SslStreamSecurityBindingElement = class
    inherit StreamUpgradeBindingElement
    interface ITransportTokenAssertionProvider
    interface IPolicyExportExtension

Public Class SslStreamSecurityBindingElement
Inherits BindingElement

Public Class SslStreamSecurityBindingElement
Inherits StreamUpgradeBindingElement

Public Class SslStreamSecurityBindingElement
Inherits StreamUpgradeBindingElement
Implements IPolicyExportExtension, ITransportTokenAssertionProvider

继承

Object

BindingElement

SslStreamSecurityBindingElement

继承

Object

BindingElement

StreamUpgradeBindingElement

SslStreamSecurityBindingElement

实现

ITransportTokenAssertionProvider IPolicyExportExtension

注解

使用面向流协议（如 TCP 和命名管道）的传输支持基于流的传输升级。 具体而言，Windows Communication Foundation (WCF) 提供安全升级。 此传输安全的配置由此类和 SslStreamSecurityBindingElement 包装，您可以对它们进行配置并将其添加到自定义绑定。 此外，第三方可以写入其自定义的 StreamSecurityBindingElement。 这些绑定元素会扩展为了生成客户端和服务器流升级提供程序而调用的 StreamUpgradeBindingElement 类。

自定义绑定包含以特定顺序排列的绑定元素集合：首先添加表示绑定堆栈顶部的元素，其次是绑定堆栈的第二个元素，依此类推。

将此类添加到绑定中

1. 创建 BindingElementCollection。

2. 在绑定堆栈中创建将位于此绑定元素之上的自定义绑定元素，比如可选的 TransactionFlowBindingElement 和 ReliableSessionBindingElement。

3. 使用 BindingElementCollection 方法，按照前面介绍的顺序将已创建的元素添加到 InsertItem。

4. 创建 SslStreamSecurityBindingElement 的实例，并将其添加到集合。

5. 将任何其他自定义绑定元素添加到集合，比如 TcpTransportBindingElement。

在三种情况下，必须在导入 WSDL 后在客户端终结点上手动指定正确的 UPN/SPN，或在客户端的 SslStreamSecurityBindingElement上指定自定义IdentityVerifier。

1. 在 WSDL 中没有发布任何服务标识。 将使用 SspiNegotiatedOverTransport 和 HTTPS（例如，其 SecurityMode 为 WSHttpBinding 的 TransportWithMessageCredential）。 如果该服务不是使用计算机标识运行的，则在导入 WSDL 后，必须在客户端终结点上手动指定正确的 UPN/SPN。

2. DNS 服务标识在 WSDL 中发布。 SspiNegotiatedOverTransport 和 SslStreamSecurityBindingElement 用于 (例如， NetTcpBinding SecurityMode = TransportWithMessageCredential) 而不是 UPN/SPN。 如果该服务不是使用计算机标识运行的，或者 DNS 标识不是计算机的标识，则在导入 WSDL 后，必须在客户端终结点上手动指定正确的 UPN/SPN。

3. 在 WSDL 中发布了 DNS 标识。 如果在客户端上重写 SslStreamSecurityBindingElement，必须在客户端的 IdentityVerifier 上指定自定义的 SslStreamSecurityBindingElement。

下面的代码演示如何在客户端终结点上手动指定正确的 UPN/SPN，以及如何在客户端的 IdentityVerifier 上指定自定义的 SslStreamSecurityBindingElement。

using System;  
using System.Collections.Generic;  
using System.Linq;  
using System.Net;  
using System.IdentityModel.Claims;  
using System.IdentityModel.Policy;  
using System.Security.Cryptography.X509Certificates;  
using System.ServiceModel;  
using System.ServiceModel.Channels;  
using System.ServiceModel.Description;  
using System.ServiceModel.Security;  
using System.Xml;  

namespace ServiceNamespace  
{  
    [ServiceContract]  
    interface IService  
    {  
        [OperationContract]  
        void DoSomething();  
    }  

    class DnsIdentityVerifier : IdentityVerifier  
    {  
        DnsEndpointIdentity _expectedIdentity;  

        public DnsIdentityVerifier(EndpointAddress serviceEndpoint)  
        {  
            _expectedIdentity = new DnsEndpointIdentity(serviceEndpoint.Uri.DnsSafeHost);  
        }  

        public override bool CheckAccess(EndpointIdentity identity, AuthorizationContext authContext)  
        {  
            Claim dnsClaim = authContext.Claims().Single(claim => claim.ClaimType == ClaimTypes.Dns);  
            return String.Equals(_expectedIdentity.IdentityClaim.Resource, dnsClaim.Resource);  
        }  

        public override bool TryGetIdentity(EndpointAddress reference, out EndpointIdentity identity)  
        {  
            identity = _expectedIdentity;  
            return true;  
        }  
    }  

    static class LinqExtensionForClaims  
    {  
        public static IEnumerable<Claim> Claims(this AuthorizationContext authContext)  
        {  
            if (null != authContext.ClaimSets)  
            {  
                foreach (ClaimSet claimSet in authContext.ClaimSets)  
                {  
                    if (null != claimSet)  
                    {  
                        foreach (Claim claim in claimSet)  
                        {  
                            yield return claim;  
                        }  
                    }  
                }  
            }  
        }  
    }  

    class Service : IService  
    {  
        public void DoSomething()  
        {  
            Console.WriteLine("Service called.");  
        }  
    }  

    class Program  
    {  
        static void Main(string[] args)  
        {  
            string hostname = Dns.GetHostEntry(String.Empty).HostName;  
            NetTcpBinding serviceBinding = new NetTcpBinding(SecurityMode.TransportWithMessageCredential);  

            ServiceHost serviceHost = new ServiceHost(typeof(Service), new Uri(String.Format("net.tcp://{0}:8080/Service", hostname)));  
            serviceHost.Credentials.ServiceCertificate.SetCertificate(StoreLocation.LocalMachine, StoreName.My, X509FindType.FindByThumbprint, "8a 42 1b eb cf 8a 14 b1 de 83 d9 a5 70 88 0a 62 f9 bf 69 06");  
            ServiceEndpoint serviceEndpoint = serviceHost.AddServiceEndpoint(typeof(IService), serviceBinding, "Endpoint");  
            serviceHost.Open();  

            CustomBinding clientBinding = new CustomBinding(serviceBinding.CreateBindingElements());  
            SslStreamSecurityBindingElement sslStream = clientBinding.Elements.Find<SslStreamSecurityBindingElement>();  
            sslStream.IdentityVerifier = new DnsIdentityVerifier(serviceEndpoint.Address);  

            ChannelFactory<IService> channelFactory = new ChannelFactory<IService>(clientBinding, new EndpointAddress(serviceEndpoint.Address.Uri, UpnEndpointIdentity.CreateUpnIdentity("username@domain")));  
            channelFactory.Credentials.Windows.AllowNtlm = false;  
            IService channel = channelFactory.CreateChannel();  
            channel.DoSomething();  
        }  
    }  

构造函数

属性

方法

显式接口实现

适用于