WCF 整合 ASP.NET Membership Provider 實作使用者名稱驗證

架構概覽

• 傳輸安全：WSHttpBinding + Message 安全模式 + UserName 憑證。
• 服務憑證：X.509 憑證加密 SOAP 訊息中的使用者名稱/密碼。
• 驗證授權：ASP.NET SqlMembershipProvider 驗證帳密，SqlRoleProvider 提供角色授權。

建立憑證

makecert -r -pe -n "CN=MyServer" -ss My -sky exchange

產生自我簽署憑證存入 CurrentUser\My，供服務端加密、客戶端驗證。

服務端設定

web.config 關鍵區段

<connectionStrings>
  <add name="SqlConn" connectionString="Data Source=.;Integrated Security=true;Initial Catalog=aspnetdb" />
</connectionStrings>

<system.web>
  <membership defaultProvider="SqlMembershipProvider">
    <providers>
      <add name="SqlMembershipProvider"
           type="System.Web.Security.SqlMembershipProvider"
           connectionStringName="SqlConn"
           applicationName="WCFMembership"
           passwordFormat="Hashed" />
    </providers>
  </membership>
  <roleManager enabled="true" defaultProvider="SqlRoleProvider">
    <providers>
      <add name="SqlRoleProvider"
           type="System.Web.Security.SqlRoleProvider"
           connectionStringName="SqlConn"
           applicationName="WCFMembership" />
    </providers>
  </roleManager>
</system.web>

<system.serviceModel>
  <services>
    <service name="WCFMembershipServices.Service1" behaviorConfiguration="MembershipBehavior">
      <endpoint address="" binding="wsHttpBinding" bindingConfiguration="Binding1"
                contract="WCFMembershipServices.IService1" />
      <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
    </service>
  </services>
  <bindings>
    <wsHttpBinding>
      <binding name="Binding1">
        <security mode="Message">
          <message clientCredentialType="UserName" />
        </security>
      </binding>
    </wsHttpBinding>
  </bindings>
  <behaviors>
    <serviceBehaviors>
      <behavior name="MembershipBehavior">
        <serviceAuthorization principalPermissionMode="UseAspNetRoles"
                              roleProviderName="SqlRoleProvider" />
        <serviceCredentials>
          <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"
                                  membershipProviderName="SqlMembershipProvider" />
          <serviceCertificate storeLocation="CurrentUser" storeName="My"
                              x509FindType="FindBySubjectName" findValue="MyServer" />
        </serviceCredentials>
      </behavior>
    </serviceBehaviors>
  </behaviors>
</system.serviceModel>

服務實作與角色授權

[ServiceContract]
public interface IService1
{
    [OperationContract]
    bool Test();
}

public class Service1 : IService1
{
    [PrincipalPermission(SecurityAction.Demand, Role = "super user")]
    public bool Test() => true;
}

客戶端呼叫

var client = new Service1Client();
client.ClientCredentials.UserName.UserName = "user1";
client.ClientCredentials.UserName.Password = "@abc123";
client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode =
    X509CertificateValidationMode.None; // 測試用，正式環境請驗證鏈
client.Test();

此架構結合 WCF 訊息安全與 ASP.NET 成熟會員體系，適合企業級內部服務統一身分管理。