问题
I need to secure a WCF Service that uses webHttpBinding with tokens, but having a hard time figuring out how to do so. It is my understanding that the recommend way of doing this is by using JWT Tokens?
I have an STS (IdentityServer) that issues JWT tokens to my Mobile Client (Sencha Touch Application) through OAuth 2.0, and this application needs to call a webHttpBinding based WCF Service.
Now I want to secure this using tokens, and I know Microsoft has released a JWT Security Token Handler NuGet package.
I have added this security token handler in the "securityTokenHandlers" tag under my "identityConfiguration" tag in the web.config, but I feel a bit lost on how to actually use the token handler to validate the token, extracting the claims and setting the IClaimsPrinicipal object.
Most examples I have been able to find use WebAPI and are for ASP.NET applications, but in my case I need to just secure an "ordinary" WCF Service using a webHttpBinding.
Any help on how to accomplish this, would be greatly appreciated.
回答1:
You won't find many samples with OAuth implementation over SOAP services. OAuth was created primarily for clients that could not handle SOAP and its associated WS-Security complexity.
Although not common, it is still possible, you just need to implement your own WCF pipeline hook (IDispatchMessageInspector) to get the token from HTTP header and then use the JWT classes to set your claims.
I have not used this code sample, but it looks like it will do what you want. http://blogs.msdn.com/b/pavelkhodak/archive/2013/07/26/enable-http-bearer-jwt-token-authentication-for-rest-service-using-webhttpbinding-in-wcf.aspx
来源：https://stackoverflow.com/questions/24351347/how-to-use-microsoft-jwt-token-handler-to-secure-webhttpbinding-based-wcf-servic