如何使用用户名/密码+ SSL与WCF配置安全RESTful服务(How to configure

我期待写一个配置文件，允许在WCF REST风格的服务，但我还是想“进军”的成员提供的用户名/密码认证的能力。

下面是使用basicHttp结合或wsHttp瓦特/ WS安全我目前配置的一部分，这将如何改变瓦特/基于REST的服务？

    <bindings>
        <wsHttpBinding>
            <binding name="wsHttp">
                <security mode="TransportWithMessageCredential">
                    <transport/>
                    <message clientCredentialType="UserName" negotiateServiceCredential="false" establishSecurityContext="false"/>
                </security>
            </binding>
        </wsHttpBinding>
        <basicHttpBinding>
            <binding name="basicHttp">
                <security mode="TransportWithMessageCredential">
                    <transport/>
                    <message clientCredentialType="UserName"/>
                </security>
            </binding>
        </basicHttpBinding>
    </bindings>
    <behaviors>
        <serviceBehaviors>
            <behavior name="NorthwindBehavior">
                <serviceMetadata httpGetEnabled="true"/>
                <serviceAuthorization principalPermissionMode="UseAspNetRoles"/>
                <serviceCredentials>
                    <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"/>
                </serviceCredentials>
            </behavior>
        </serviceBehaviors>
    </behaviors>

Answer 1:

这里有与ASP.net成员资格提供保障WCF REST服务播客：

http://channel9.msdn.com/posts/rojacobs/endpointtv-Securing-RESTful-services-with-ASPNET-Membership/

Answer 2:

我达雷尔同意在WCF复杂REST场景是一个坏主意。它只是不漂亮。

然而，多米尼克拜尔有一些好的帖子这个对他最小特权博客。

如果你想看到的WSSE身份验证支持回退到上的FormsAuthenticationTicket WCF的支持，请查看BlogService的源代码。

Answer 3:

Before you continue down this path of fighting to implement REST over WCF, I suggest you read this post by Tim Ewald. I was especially impacted by the following statement:

I'm not sure I want to build on a layer designed to factor HTTP in on top of a layer that was designed to factor it out.

I've spent the last 12 months developing REST based stuff with WCF and that statement has proven itself to be so true over and over again. IMHO what WCF brings to the table is outweighed by the complexity it introduces for doing REST work.