使用OAuth方式保护你的WCF Service(通过Azure ACS)

大家好，今天我们来分享一下在Windows Azure平台上如何保护你部署的WCF Service。

之前我有过一篇文章介绍Azure的Access Control Service（http://blog.csdn.net/aa466564931/article/details/7546415）, 这里我们将要介绍如何来使用他保护部署在Azure云计算平台上面的应用程序或者是对外的Service。

在开始介绍之前，先来说明一下我们这里使用的ACS OAuth方式，这里我们用到的是ACS的Service Identities，并且使用Service Identities的密码作为访问WCF service的凭据，客户端只有通过验证（这里将会生成一个基于此密码的OAuth令牌，令牌含有用户名，创建时间，过期时间，验证的唯一标识等信息）才能够访问到我们部署好的service，提供了一种较为安全的方式。

好了，下面开始如何创建这样一个service，当然我们必须要有的Azure的账号（可以申请免费试用的账号），现在Azure还没有在中国正式release，所以注册稍微会麻烦一些，需要一个境外的电话和用于支付的信用卡（信用卡无需是境外的），你可以提供一个香港的电话或者联系微软的support来完成注册。

拥有账号之后请访问（windows.azure.com）访问Azure的管理页面，在这里我们可以部署自己的application, service，提供证书，使用各种服务和功能等等。具体的大家可以边看边试试。这里我们点击“服务总线，访问控制和缓存”按钮，点击访问控制（Access Control）,并且创建一个访问控制的命名空间（如果已经创建好了，跳过这一步），最后单击工具栏的访问控制跳转到ACS的配置页面。

在左边的panel中选择Service Identities, 点击添加来创建一个新的indentity，按照描述信息依次键入名称，描述信息。在类型这一栏，我们选择密码方式作为我们的验证的credential, 并且输入你想设置的密码，完了设置有效时期和过期时间，点击保存按钮。这样你在ACS上的配置工作就完成了。

下面我们来做具体的代码编写工作，首先我们创建一个WCF Service，这个service将被ACS保护，并且通过验证才能访问它，为了简便我们这里仅仅创建几个简单的方法，例如获取用户的个人信息，添加新用户等方法，下面贴一段给大家看看，interface和User类的定义就不列举了，非常简单，大家可以通过下载完整sample来看更详细的信息。

[本示例完整源码下载(0分)]http://download.csdn.net/detail/aa466564931/4455947

UserService.cs

    public class UserService : IUserService
    {
        List<User> users = new List<User>();

        /// <summary>
        /// Add default users.
        /// </summary>
        public UserService()
        {
            User user = new User();
            user.UserId = "1";
            user.FirstName = "Jim";
            user.LastName = "James";
            User user2 = new User();
            user2.UserId = "2";
            user2.FirstName = "Nancy";
            user2.LastName = "Wang";
            users.Add(user);
            users.Add(user2);
        }

        /// <summary>
        /// Return all users.
        /// </summary>
        /// <returns></returns>
        public List<User> GetAllUsers()
        {
            return users;
        }

        /// <summary>
        /// Add a new user in user list.
        /// </summary>
        /// <param name="u"></param>
        /// <returns></returns>
        public bool AddNewUser(User u)
        {
            if (!users.Exists(e => e.UserId == u.UserId))
            {
                users.Add(u);
                return true;
            }
            else
            {
                return false;
            }
        }

        /// <summary>
        /// Get user info by id.
        /// </summary>
        /// <param name="userId"></param>
        /// <returns></returns>
        public User GetUser(string userId)
        {
            if (users.Exists(e => e.UserId == userId))
            {
                return users.Find(f => f.UserId == userId);
            }
            else
            {
                User user = new User();
                user.UserId = "";
                return user;    
            }
        }
    }

OK, Service创建完成了，你可以把它部署到ACS或者是其他Server。下面我们来创建一个安全模块来保护这个Service，这个模块有两个类，一个为SWTModule.cs，他用于设置SWT类型令牌的信任关系，这里需要你吧刚刚在Azure ACS管理页面上设置信息写入了，例如ACS的命名空间，你的密码和acs路径。他是继承与IHttpModule接口的，也就是说在调用Service之前，你需要通过这个HttpModule的验证。另外一个类时TokenValidator，如字面意思，这个类用来检查你的Token的正确性，包括检查你的Token的名字，信任的key，过期时间，SHA-256加密等等. 这两个类是验证功能的核心部分。

SWTMoudle.cs:

    class SWTMoudle : IHttpModule
    {
        string serviceNamespace = "<Your ACS namespace>";
        string acsHostName = "accesscontrol.windows.net";
        // Certificate and keys
        string trustedTokenPolicyKey = "<Your Signing certificate symmetric key>";
        // Service Realm
        string trustedAudience = "<Your ACS service path>";


        void IHttpModule.Dispose()
        {

        }

        void IHttpModule.Init(HttpApplication context)
        {
            context.BeginRequest += new EventHandler(context_BeginRequest);
        }

        void context_BeginRequest(object sender, EventArgs e)
        {
            if (HttpContext.Current.Request.Url.AbsolutePath.EndsWith(".svc"))
            {
                // Get the authorization header
                string headerValue = HttpContext.Current.Request.Headers.Get("Authorization");

                // Check that a value is there
                if (string.IsNullOrEmpty(headerValue))
                {
                    throw new ApplicationException("unauthorized");
                }

                // Check that it starts with 'WRAP'
                if (!headerValue.StartsWith("WRAP "))
                {
                    throw new ApplicationException("unauthorized");
                }

                string[] nameValuePair = headerValue.Substring("WRAP ".Length).Split(new char[] { '=' }, 2);

                if (nameValuePair.Length != 2 ||
                    nameValuePair[0] != "access_token" ||
                    !nameValuePair[1].StartsWith("\"") ||
                    !nameValuePair[1].EndsWith("\""))
                {
                    throw new ApplicationException("unauthorized");
                }

                // Trim off the leading and trailing double-quotes
                string token = nameValuePair[1].Substring(1, nameValuePair[1].Length - 2);

                // Create a token validate
                TokenValidator validator = new TokenValidator(
                    this.acsHostName,
                    this.serviceNamespace,
                    this.trustedAudience,
                    this.trustedTokenPolicyKey);

                // Validate the token
                if (!validator.Validate(token))
                {
                    throw new ApplicationException("unauthorized");
                }
            }
        }

    }

TokenValidator.cs

    public class TokenValidator
    {
        private string issuerLabel = "Issuer";
        private string expiresLabel = "ExpiresOn";
        private string audienceLabel = "Audience";
        private string hmacSHA256Label = "HMACSHA256";

        private string acsHostName;

        private string trustedSigningKey;
        private string trustedTokenIssuer;
        private string trustedAudienceValue;

        /// <summary>
        /// Token validate constructor method.
        /// </summary>
        /// <param name="acsHostName"></param>
        /// <param name="serviceNamespace"></param>
        /// <param name="trustedAudienceValue"></param>
        /// <param name="trustedSigningKey"></param>
        public TokenValidator(string acsHostName, string serviceNamespace, string trustedAudienceValue, string trustedSigningKey)
        {
            this.trustedSigningKey = trustedSigningKey;
            this.trustedTokenIssuer = String.Format("https://{0}.{1}/",
                serviceNamespace.ToLowerInvariant(),
                acsHostName.ToLowerInvariant());

            this.trustedAudienceValue = trustedAudienceValue;
        }

        public bool Validate(string token)
        {
            if (!this.IsHMACValid(token, Convert.FromBase64String(this.trustedSigningKey)))
            {
                return false;
            }

            if (this.IsExpired(token))
            {
                return false;
            }

            if (!this.IsIssuerTrusted(token))
            {
                return false;
            }

            if (!this.IsAudienceTrusted(token))
            {
                return false;
            }

            return true;
        }

        public Dictionary<string, string> GetNameValues(string token)
        {
            if (string.IsNullOrEmpty(token))
            {
                throw new ArgumentException();
            }

            return
                token
                .Split('&')
                .Aggregate(
                new Dictionary<string, string>(),
                (dict, rawNameValue) =>
                {
                    if (rawNameValue == string.Empty)
                    {
                        return dict;
                    }

                    string[] nameValue = rawNameValue.Split('=');

                    if (nameValue.Length != 2)
                    {
                        throw new ArgumentException("Invalid formEncodedstring - contains a name/value pair missing an = character");
                    }

                    if (dict.ContainsKey(nameValue[0]) == true)
                    {
                        throw new ArgumentException("Repeated name/value pair in form");
                    }

                    dict.Add(HttpUtility.UrlDecode(nameValue[0]), HttpUtility.UrlDecode(nameValue[1]));
                    return dict;
                });
        }

        private static ulong GenerateTimeStamp()
        {
            // Default implementation of epoch time
            TimeSpan ts = DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, 0);
            return Convert.ToUInt64(ts.TotalSeconds);
        }

        private bool IsAudienceTrusted(string token)
        {
            Dictionary<string, string> tokenValues = this.GetNameValues(token);

            string audienceValue;

            tokenValues.TryGetValue(this.audienceLabel, out audienceValue);

            if (!string.IsNullOrEmpty(audienceValue))
            {
                if (audienceValue.Equals(this.trustedAudienceValue, StringComparison.Ordinal))
                {
                    return true;
                }
            }

            return false;
        }

        private bool IsIssuerTrusted(string token)
        {
            Dictionary<string, string> tokenValues = this.GetNameValues(token);

            string issuerName;

            tokenValues.TryGetValue(this.issuerLabel, out issuerName);

            if (!string.IsNullOrEmpty(issuerName))
            {
                if (issuerName.Equals(this.trustedTokenIssuer))
                {
                    return true;
                }
            }

            return false;
        }

        private bool IsHMACValid(string swt, byte[] sha256HMACKey)
        {
            string[] swtWithSignature = swt.Split(new string[] { "&" + this.hmacSHA256Label + "=" }, StringSplitOptions.None);

            if ((swtWithSignature == null) || (swtWithSignature.Length != 2))
            {
                return false;
            }

            HMACSHA256 hmac = new HMACSHA256(sha256HMACKey);

            byte[] locallyGeneratedSignatureInBytes = hmac.ComputeHash(Encoding.ASCII.GetBytes(swtWithSignature[0]));

            string locallyGeneratedSignature = HttpUtility.UrlEncode(Convert.ToBase64String(locallyGeneratedSignatureInBytes));

            return locallyGeneratedSignature == swtWithSignature[1];
        }

        private bool IsExpired(string swt)
        {
            try
            {
                Dictionary<string, string> nameValues = this.GetNameValues(swt);
                string expiresOnValue = nameValues[this.expiresLabel];
                ulong expiresOn = Convert.ToUInt64(expiresOnValue);
                ulong currentTime = Convert.ToUInt64(GenerateTimeStamp());

                if (currentTime > expiresOn)
                {
                    return true;
                }

                return false;
            }
            catch (KeyNotFoundException)
            {
                throw new ArgumentException();
            }
        }

    }

好，创建完Security这块功能之后呢，现在我们要做的就是访问这个service了，这里仅仅为了测试，所以我会把Token的输出出来看看，如果实际运用的话则不能列出来了，因为Token还是包含了很多用户的信息的。

创建一个Silverlight客户端，添加一些基本的控件在MainPage.xaml上：

    <Grid x:Name="LayoutRoot" Background="White">
        <Grid.RowDefinitions >
            <RowDefinition Height="100"></RowDefinition>
            <RowDefinition Height="60"></RowDefinition>
            <RowDefinition Height="*"></RowDefinition>
        </Grid.RowDefinitions>
        <Button Content="Click for Token" Height="23" Grid.Row="1" HorizontalAlignment="Left"  Name="btnLogin" VerticalAlignment="Top" Width="153" Click="btnToken_Click" />
        <TextBox Grid.Row="0"  Name="tbToken" HorizontalScrollBarVisibility="Visible" IsReadOnly="True" />
        <Button Content="Click for Data" Height="23" HorizontalAlignment="Left" Margin="170,0,0,0" Name="btnData" VerticalAlignment="Top" Width="153" Grid.Row="1" Click="btnData_Click" />
        <sdk:Label Grid.Row="1" Height="28" HorizontalAlignment="Left" Margin="1,29,0,0" Name="lbContent" VerticalAlignment="Top" Width="120" />
        <sdk:DataGrid AutoGenerateColumns="True"  Grid.Row="2"  HorizontalAlignment="Left"  Name="dtgContent" VerticalAlignment="Top"  />

    </Grid>

下面的后台代码，调用Service方需要输入你需要访问ACS的地址以及密码等信息：

MainPage.xaml.cs

    public partial class MainPage : UserControl
    {
        /// <summary>
        /// Necessary variables from ACS Portal.
        /// </summary>
        const string serviceNamespace = "<Your ACS namespace>";
        const string acsHostUrl = "accesscontrol.windows.net";
        const string realm = "<Your ACS service path>";
        const string userUrl = "<The user service path>";
        const string uid = "<Your service identity name>";
        const string pwd = "<Your service identity password>";
        string variables;
        string tokenString;
        public MainPage()
        {
            InitializeComponent();
        }

        /// <summary>
        /// Get Token from ACS.
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void btnToken_Click(object sender, RoutedEventArgs e)
        {
            string token = GetTokenFromACS(realm);
        }

        /// <summary>
        /// Access WCF service.
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        private void btnData_Click(object sender, RoutedEventArgs e)
        {
            if (!tbToken.Text.Trim().Equals(string.Empty))
            {
                HttpWebRequest request = HttpWebRequest.Create(userUrl) as HttpWebRequest;
                string headerValue = string.Format("WRAP access_token=\"{0}\"", tokenString);
                request.Method = "GET";
                request.Headers["Authorization"] = headerValue;
                AsyncCallback callBack = new AsyncCallback(LoginGetResponse);
                request.BeginGetResponse(callBack, request);

            }
            else
            {
                lbContent.Content = "Please get token first.";
            }
        }

        /// <summary>
        /// Display data from WCF service.
        /// </summary>
        /// <param name="result"></param>
        public void LoginGetResponse(IAsyncResult result)
        {
            HttpWebRequest request = result.AsyncState as HttpWebRequest;
            HttpWebResponse response = request.EndGetResponse(result) as HttpWebResponse;
            string obj = string.Empty;
            using (StreamReader reader = new StreamReader(response.GetResponseStream()))
            {
                obj = reader.ReadToEnd();
            }
            XDocument document = XDocument.Parse(obj);
            var list = from d in document.Descendants("User")
                       select new User
                       {
                           UserId = d.Element("UserId").Value,
                           FirstName = d.Element("FirstName").Value,
                           LastName = d.Element("LastName").Value
                       };
            ObservableCollection<User> collection = new ObservableCollection<User>();
            foreach (User user in list)
            {
                collection.Add(user);
            }

            Dispatcher.BeginInvoke(() =>
                {
                    dtgContent.ItemsSource = collection;
                });

        }


        /// <summary>
        /// Get Token from ACS portal.
        /// </summary>
        /// <param name="scope"></param>
        /// <returns></returns>
        private string GetTokenFromACS(string scope)
        {
            string wrapPassword = pwd;
            string wrapUsername = uid;

            // request a token from ACS
            string address = string.Format("https://{0}.{1}/WRAPv0.9", serviceNamespace, acsHostUrl);
            HttpWebRequest requestToken = (HttpWebRequest)HttpWebRequest.Create(address);
            variables = string.Format("{0}={1}&{2}={3}&{4}={5}", "wrap_name", wrapUsername, "wrap_password", wrapPassword, "wrap_scope", scope);
            requestToken.Method = "POST";
            AsyncCallback callBack = new AsyncCallback(EndGetRequestStream);
            requestToken.BeginGetRequestStream(callBack, requestToken);
            return tokenString;
        }

        public void EndGetRequestStream(IAsyncResult result)
        {
            HttpWebRequest requestToken = result.AsyncState as HttpWebRequest;
            Stream stream = requestToken.EndGetRequestStream(result);
            byte[] bytes = Encoding.UTF8.GetBytes(variables);
            stream.Write(bytes, 0, bytes.Length);
            stream.Close();
            requestToken.BeginGetResponse(TokenEndReponse, requestToken);
        }

        public void TokenEndReponse(IAsyncResult result)
        {
            HttpWebRequest requestToken = result.AsyncState as HttpWebRequest;
            HttpWebResponse responseToken = requestToken.EndGetResponse(result) as HttpWebResponse;
            using(StreamReader reader = new StreamReader(responseToken.GetResponseStream()))
            {
                tokenString = reader.ReadToEnd();
            }

            string resultString = HttpUtility.UrlDecode(
                tokenString
                .Split('&')
                .Single(value => value.StartsWith("wrap_access_token=", StringComparison.OrdinalIgnoreCase))
                .Split('=')[1]);
            tokenString = resultString;
            Dispatcher.BeginInvoke(() =>
                {
                    tbToken.Text = resultString;
                });

        }


    }

OK, 现在你可以通过启动Silverlight项目来调用Service了，先点击Click for Token 后点击Click for data.

我还创建一个控制台程序来调用它，效果是一样的：

    class Program
    {
        /// <summary>
        /// Necessary variables from ACS Portal.
        /// </summary>
        static string serviceNamespace = "<Your ACS namespace>";
        static string acsHostUrl = "accesscontrol.windows.net";
        static string realm = "<Your ACS service path>";
        static string userUrl = "<Your user service path>";
        static string uid = "<Your service identity name>";
        static string pwd = "<Your service identity password>";

        /// <summary>
        /// Access the service via ACS Token.
        /// </summary>
        /// <param name="args"></param>
        static void Main(string[] args)
        {
            string token = GetTokenFromACS(realm);

            WebClient client = new WebClient();

            string headerValue = string.Format("WRAP access_token=\"{0}\"", token);

            HttpWebRequest request = HttpWebRequest.Create(userUrl) as HttpWebRequest;
            request.ContentLength = 0;
            request.Method = "GET";
            request.Headers["Authorization"] = headerValue;

            HttpWebResponse response = request.GetResponse() as HttpWebResponse;
            using (StreamReader reader = new StreamReader(response.GetResponseStream()))
            {
                string obj = reader.ReadToEnd();
                Console.Write(obj);
                Console.ReadLine();
            }
        }

        /// <summary>
        /// Get Token from ACS.
        /// </summary>
        /// <param name="scope"></param>
        /// <returns></returns>
        private static string GetTokenFromACS(string scope)
        {
            string wrapPassword = pwd;
            string wrapUsername = uid;

            // request a token from ACS
            WebClient client = new WebClient();
            client.BaseAddress = string.Format("https://{0}.{1}", serviceNamespace, acsHostUrl);

            NameValueCollection values = new NameValueCollection();
            values.Add("wrap_name", wrapUsername);
            values.Add("wrap_password", wrapPassword);
            values.Add("wrap_scope", scope);

            byte[] responseBytes = client.UploadValues("WRAPv0.9/", "POST", values);

            string response = Encoding.UTF8.GetString(responseBytes);

            Console.WriteLine("\nreceived token from ACS: {0}\n", response);

            return HttpUtility.UrlDecode(
                response
                .Split('&')
                .Single(value => value.StartsWith("wrap_access_token=", StringComparison.OrdinalIgnoreCase))
                .Split('=')[1]);
        }


    }

好了，你也可以试试运行一下这个控制台程序。