1

基本上我需要设置我的 ASMX 文件，以便当我在浏览器中将其拉起以显示 WebMethod 规范时，Soap Header 符合以下格式：

<soap:Header>
   <wsse:Security>
      <wsse:UsernameToken wsu:Id='SecurityToken-securityToken'>
         <wsse:Username>Username</wsse:Username>
         <wsse:Password>Password</wsse:Password>
         <wsu:Created>Timestamp</wsu:Created>
      </wsse:UsernameToken>
   </wsse:Security>
</soap:Header>

背景故事：我正在与已经构建（并由另一家公司拥有）的客户端应用程序集成。基本上，这个客户端应用程序已经从过去与其他公司的集成中设置了所有的肥皂消息。因此，我们选择只使用与他们已经设置使用的 WSDL 匹配的 ASMX 文件来构建 Web 服务。

是否可以让 WS-Security 处理 ASMX 文件，或者 ASMX 过于简单，我必须升级到 WFC（我真的不想这样做）？

4

3 回答 3

3

Is it possible to get WS-Security working on an ASMX file or is ASMX too simplistic and I have to upgrade to WFC (which I really don't want to do)?

Yes, it is possible using Web Services Enhancements 3 (an add-on for Visual Studio 2005 and ASMX). See this MSDN page for a WSE-3-specific tutorial and use the usernameOverTransportSecurity assertion, noting that this is not actually secure unless the connection takes place over a protected transport (i.e. SSL).

It is, however, not recommended that you do this, and I cannot fathom why you would not "want" to "upgrade to WCF" given the choice. Please note the following very important limitations of ASMX/WSE:

  • WSE is no longer a supported product. Although it still works, it no longer receives updates or even bug fixes.

  • No version of WSE will successfully integrate into Visual Studio 2008, or even Visual Studio 2005 running on Windows Vista x64 or newer.

  • WCF goes to a lot of trouble to provide thread-safe client operations and allow proxies to exist for long periods of time (which in turn provide significant per-operation performance benefits). WSE proxies, on the other hand, are disposable non-threadsafe objects that incur a setup time with every remote method invocation (even when using Secure Conversation). This also makes them largely unsuitable for Dependency Injection and many other widely-used patterns.

These are just some of the reasons why you shouldn't use WSE anymore. The reasons why you should use WCF on the client side are manifold, including but not limited to separation of the model and proxies, consumption of REST-based services, and better handling of collection types.

Unless you really must continue to use ASMX, please reconsider your refusal to move to WCF - unless the service does a lot of unusual things with XML serialization, it takes no more than 5 minutes to make the switch.

于 2010-03-27T14:33:12.167 回答
2

不，旧版 ASMX Web 服务不支持 WS-Security 或任何其他 WS-* 标准。

由于 Microsoft 现在认为 ASMX Web 服务是“遗留技术”，因此您应该使用 WCF 来完成这项工作。

另一个答案建议使用 WSE。这甚至不是一个解决方案。WSE 已完全过时，只能作为最后的手段使用。

于 2010-03-27T06:29:16.543 回答
1

您可以使用经典 Web 服务实现 SOAP/WS-Security 服务。这是来自 MSDN的教程。

不过，所有这些在 WCF 中都更容易。

编辑：

拉错链接了。 这是我要粘贴的那个（使用 WSE 2 的 CodeProject 教程，尽管 WSE 3 是最新版本，我只使用了 WCF 之前的版本）。

于 2010-03-26T22:27:19.233 回答