作法：建立自訂權杖

發行項
04/07/2023

本主題說明如何使用 SecurityToken 類別來建立自訂安全性權杖，以及如何將它與自訂安全性權杖提供者和驗證器整合。如需完整的程式碼範例，請參閱自訂權杖範例。

「安全性權杖」基本上是一種 XML 元素，可由 WCF 安全性架構用來表示 SOAP 訊息內部關於傳送者的宣告。 WCF 安全性會為系統所提供的驗證模式提供各種權杖。範例包括 X509SecurityToken 類別所代表的 X.509 憑證安全性權杖，或是 UserNameSecurityToken 類別所代表的使用者名稱安全性權杖。

有時候提供的類型並不支援驗證模式或認證。在此情況下，您就需要建立自訂安全性權杖，以便在 SOAP 訊息內部提供自訂認證的 XML 表示法。

下列程序說明如何建立自訂安全性權杖，以及如何將它與 WCF 安全性基礎結構整合。本主題將建立信用卡權杖，它可以用來將用戶端的信用卡相關資訊傳遞給伺服器。

如需自訂認證和安全性權杖管理員的詳細資訊，請參閱逐步解說：建立自訂用戶端和服務認證。

如需其他代表安全性權杖的類別，請參閱 System.IdentityModel.Tokens 命名空間。

程序

您必須提供用戶端應用程式為安全性基礎結構指定信用卡資訊的方式，此資訊可由自訂用戶端認證類別提供給應用程式使用。第一步就是為自訂用戶端認證建立代表信用卡資訊的類別。

若要在用戶端認證內部建立代表信用卡資訊的類別

為應用程式定義代表信用卡資訊的新類別。下列範例將類別命名為 CreditCardInfo。

將適當的屬性加入至類別，讓應用程式能夠設定自訂權杖所需的必要資訊。在此範例中，類別具有三種屬性：CardNumber、CardIssuer 和 ExpirationDate。

public class CreditCardInfo
{
    string cardNumber;
    string cardIssuer;
    DateTime expirationDate;

    public CreditCardInfo(string cardNumber, string cardIssuer, DateTime expirationDate)
    {
        this.cardNumber = cardNumber;
        this.cardIssuer = cardIssuer;
        this.expirationDate = expirationDate;
    }

    public string CardNumber
    {
        get { return this.cardNumber; }
    }

    public string CardIssuer
    {
        get { return this.cardIssuer; }
    }

    public DateTime ExpirationDate
    {
        get { return this.expirationDate; }
    }
}

Public Class CreditCardInfo

    Private _cardNumber As String
    Private _cardIssuer As String
    Private _expirationDate As DateTime

    Public Sub New(ByVal cardNumber As String, ByVal cardIssuer As String, _
                   ByVal expirationDate As DateTime)
        Me._cardNumber = cardNumber
        Me._cardIssuer = cardIssuer
        Me._expirationDate = expirationDate
    End Sub

    Public ReadOnly Property CardNumber() As String
        Get
            Return Me._cardNumber
        End Get
    End Property

    Public ReadOnly Property CardIssuer() As String
        Get
            Return Me._cardIssuer
        End Get
    End Property

    Public ReadOnly Property ExpirationDate() As DateTime
        Get
            Return Me._expirationDate
        End Get
    End Property

End Class

接下來，必須建立可代表自訂安全性權杖的類別。安全性權杖提供者、驗證器和序列化程式類別會使用此類別，從 WCF 安全性基礎結構傳遞安全性權杖的相關資訊，或是將資訊傳遞至其中。

若要建立自訂安全性權杖類別

定義衍生自 SecurityToken 類別的新類別。本範例會建立名為 CreditCardToken 的類別。
覆寫 Id 屬性。這個屬性是用來取得安全性權杖的區域識別項，該識別項則是用來指向 SOAP 訊息內來自其他項目的安全性權杖 XML 表示法。在此範例中，可以將權杖識別項當成建構函式參數傳遞給它，否則每次建立安全性權杖執行個體時，就會產生新的隨機權杖識別項。
實作 SecurityKeys 屬性。此屬性會傳回安全性權杖執行個體所代表的安全性金鑰集合。可使用這些金鑰來簽署或加密部分 SOAP 訊息。在此範例中，信用卡安全性權杖無法包含任何安全性金鑰；因此，實作一律會傳回空的集合。

覆寫 ValidFrom 和 ValidTo 屬性。 WCF 會使用這些屬性來判斷安全性權杖執行個體的有效性。在此範例中，信用卡安全性權杖只擁有一個到期日，因此 ValidFrom 屬性會傳回 DateTime，這個值代表執行個體的建立日期與時間。

class CreditCardToken : SecurityToken
{
    CreditCardInfo cardInfo;
    DateTime effectiveTime = DateTime.UtcNow;
    string id;
    ReadOnlyCollection<SecurityKey> securityKeys;

    public CreditCardToken(CreditCardInfo cardInfo) : this(cardInfo, Guid.NewGuid().ToString()) { }

    public CreditCardToken(CreditCardInfo cardInfo, string id)
    {
        if (cardInfo == null)
        {
            throw new ArgumentNullException("cardInfo");
        }
        if (id == null)
        {
            throw new ArgumentNullException("id");
        }

        this.cardInfo = cardInfo;
        this.id = id;
        // The credit card token is not capable of any cryptography.
        this.securityKeys = new ReadOnlyCollection<SecurityKey>(new List<SecurityKey>());
    }

    public CreditCardInfo CardInfo
    {
        get { return this.cardInfo; }
    }

    public override ReadOnlyCollection<SecurityKey> SecurityKeys
    {
        get { return this.securityKeys; }
    }

    public override DateTime ValidFrom
    {
        get { return this.effectiveTime; }
    }

    public override DateTime ValidTo
    {
        get { return this.cardInfo.ExpirationDate; }
    }

    public override string Id
    {
        get { return this.id; }
    }
}

Friend Class CreditCardToken
    Inherits SecurityToken

    Private _cardInfo As CreditCardInfo
    Private _effectiveTime As DateTime = DateTime.UtcNow
    Private _id As String
    Private _securityKeys As ReadOnlyCollection(Of SecurityKey)

    Public Sub New(ByVal cardInfo As CreditCardInfo)
        Me.New(cardInfo, Guid.NewGuid().ToString())
    End Sub

    Public Sub New(ByVal cardInfo As CreditCardInfo, _
                   ByVal id As String)
        If cardInfo Is Nothing Then
            Throw New ArgumentNullException("cardInfo")
        End If
        If id Is Nothing Then
            Throw New ArgumentNullException("id")
        End If

        Me._cardInfo = cardInfo
        Me._id = id
        ' The credit card token is not capable of any cryptography.
        Me._securityKeys = New ReadOnlyCollection(Of SecurityKey)(New List(Of SecurityKey)())
    End Sub

    Public ReadOnly Property CardInfo() As CreditCardInfo
        Get
            Return Me._cardInfo
        End Get
    End Property

    Public Overrides ReadOnly Property SecurityKeys() As ReadOnlyCollection(Of SecurityKey)
        Get
            Return Me._securityKeys
        End Get
    End Property

    Public Overrides ReadOnly Property ValidFrom() As DateTime
        Get
            Return Me._effectiveTime
        End Get
    End Property

    Public Overrides ReadOnly Property ValidTo() As DateTime
        Get
            Return Me._cardInfo.ExpirationDate
        End Get
    End Property

    Public Overrides ReadOnly Property Id() As String
        Get
            Return Me._id
        End Get
    End Property
End Class

新的安全性權杖類型建立完畢後，需要實作 SecurityTokenParameters 類別。這項實作會在安全性繫結項目組態中用來代表新的權杖類型。安全性權杖參數類別可當成範本，用來比對實際安全性權杖執行個體與訊息處理時間。範本所提供的其他屬性可供應用程式用來指定準則，安全性權杖必須符合這個準則才能加以使用或驗證。下列範例並未新增任何其他屬性，因此當 WCF 基礎結構搜尋要使用或驗證的安全性權杖執行個體時，只會比對安全性權杖型別。

若要建立自訂安全性權杖參數類別

定義衍生自 SecurityTokenParameters 類別的新類別。
實作 CloneCore 方法。複製類別中已定義的所有內部欄位 (如果有的話)。此範例並未定義任何其他欄位。
實作 SupportsClientAuthentication 唯讀屬性。如果此類別所代表的安全性權杖類型可用來驗證服務的用戶端，則這個屬性會傳回 true。在此範例中，信用卡安全性權杖可用來驗證服務的用戶端。
實作 SupportsServerAuthentication 唯讀屬性。如果此類別所代表的安全性權杖類型可用來驗證用戶端服務，則這個屬性會傳回 true。在此範例中，信用卡安全性權杖不可用來驗證用戶端服務。
實作 SupportsClientWindowsIdentity 唯讀屬性。如果此類別所代表的安全性權杖類型可用來對應至 Windows 帳戶，則這個屬性會傳回 true。因此，驗證結果會由 WindowsIdentity 類別執行個體來表示。在此範例中，權杖無法對應至 Windows 帳戶。
實作 CreateKeyIdentifierClause(SecurityToken, SecurityTokenReferenceStyle) 方法。 WCF 安全性架構需要此安全性權杖參數類別來代表安全性權杖執行個體的參照時，即會呼叫此方法。實際安全性權杖執行個體與可指定所要求之參考型別的 SecurityTokenReferenceStyle 會同時當成引數傳遞至此方法。在此範例中，信用卡安全性權杖僅支援內部參考。 SecurityToken 類別具有建立內部參考的功能，因此實作不需要其他程式碼。

實作 InitializeSecurityTokenRequirement(SecurityTokenRequirement) 方法。 WCF 會呼叫此方法，將安全性權杖參數類別執行個體轉換為SecurityTokenRequirement類別的執行個體。安全性權杖提供者會使用此結果來建立適當的安全性權杖執行個體。

public class CreditCardTokenParameters : SecurityTokenParameters
{
    public CreditCardTokenParameters()
    {
    }

    protected CreditCardTokenParameters(CreditCardTokenParameters other)
        : base(other)
    {
    }

    protected override SecurityTokenParameters CloneCore()
    {
        return new CreditCardTokenParameters(this);
    }

    protected override void InitializeSecurityTokenRequirement(SecurityTokenRequirement requirement)
    {
        requirement.TokenType = Constants.CreditCardTokenType;
        return;
    }

    // A credit card token has no cryptography, no windows identity, and supports only client authentication.
    protected override bool HasAsymmetricKey
    {
        get { return false; }
    }

    protected override bool SupportsClientAuthentication
    {
        get { return true; }
    }

    protected override bool SupportsClientWindowsIdentity
    {
        get { return false; }
    }

    protected override bool SupportsServerAuthentication
    {
        get { return false; }
    }

    protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
    {
        if (referenceStyle == SecurityTokenReferenceStyle.Internal)
        {
            return token.CreateKeyIdentifierClause<LocalIdKeyIdentifierClause>();
        }
        else
        {
            throw new NotSupportedException("External references are not supported for credit card tokens");
        }
    }
}

Public Class CreditCardTokenParameters
    Inherits SecurityTokenParameters

    Public Sub New()
    End Sub

    Protected Sub New(ByVal other As CreditCardTokenParameters)
        MyBase.New(other)
    End Sub

    Protected Overrides Function CloneCore() As SecurityTokenParameters
        Return New CreditCardTokenParameters(Me)
    End Function

    Protected Overrides Sub InitializeSecurityTokenRequirement(ByVal requirement As SecurityTokenRequirement)
        requirement.TokenType = Constants.CreditCardTokenType
        Return
    End Sub

    ' A credit card token has no cryptography, no windows identity, and supports only client authentication.
    Protected Overrides ReadOnly Property HasAsymmetricKey() As Boolean
        Get
            Return False
        End Get
    End Property

    Protected Overrides ReadOnly Property SupportsClientAuthentication() As Boolean
        Get
            Return True
        End Get
    End Property

    Protected Overrides ReadOnly Property SupportsClientWindowsIdentity() As Boolean
        Get
            Return False
        End Get
    End Property

    Protected Overrides ReadOnly Property SupportsServerAuthentication() As Boolean
        Get
            Return False
        End Get
    End Property

    Protected Overrides Function CreateKeyIdentifierClause(ByVal token As SecurityToken, _
                                                           ByVal referenceStyle As SecurityTokenReferenceStyle) As SecurityKeyIdentifierClause
        If referenceStyle = SecurityTokenReferenceStyle.Internal Then
            Return token.CreateKeyIdentifierClause(Of LocalIdKeyIdentifierClause)()
        Else
            Throw New NotSupportedException("External references are not supported for credit card tokens")
        End If
    End Function

End Class

安全性權杖會在 SOAP 訊息內傳輸，這麼做需要在記憶體中的安全性權杖表示與網路上的表示之間使用轉譯機制。 WCF 會使用安全性權杖序列化程式來完成這項工作。每個自訂權杖必須搭配自訂安全性權杖序列化程式，這個程式可以序列化與還原序列化來自 SOAP 訊息的自訂安全性權杖。

注意

衍生金鑰預設為啟用。當您建立自訂的安全性權杖並將它當做主要權杖時，WCF 會自其衍生出金鑰。這時，它會呼叫自訂安全性權杖序列化程式來寫入自訂安全性權杖的 SecurityKeyIdentifierClause，同時將 DerivedKeyToken 序列化至連線。在接收端，將連線上的權杖還原序列化時，DerivedKeyToken 序列化程式需要 SecurityTokenReference 項目做為它底下的最上層子項目。如果自訂安全性權杖序列化程式在序列化其子句型別時未加入 SecurityTokenReference 項目，則會擲回例外狀況。

若要建立自訂安全性權杖序列化程式

定義衍生自 WSSecurityTokenSerializer 類別的新類別。
覆寫 CanReadTokenCore(XmlReader) 方法，這個方法需要靠 XmlReader 讀取 XML 串流。如果序列化程式實作可以根據目前指定的項目來還原序列化安全性權杖，則方法會傳回 true。在此範例中，此方法會檢查 XML 讀取器目前的 XML 項目是否具備正確的項目名稱與命名空間。如果不具備的話，它會呼叫此方法的基底類別實作來處理 XML 項目。
覆寫 ReadTokenCore(XmlReader, SecurityTokenResolver) 方法。此方法會讀取安全性權杖的 XML 內容，並且為權杖建構適當的記憶體內部表示法。如果它無法辨識傳入之 XML 讀取器所在的 XML 項目，則會呼叫基底類別實作來處理系統提供的權杖類型。
覆寫 CanWriteTokenCore(SecurityToken) 方法。如果此方法可將記憶體內部的權杖表示法 (當成引數傳入) 轉換為 XML 表示法，則會傳回 true。如果無法轉換，則會呼叫基底類別實作。

覆寫 WriteTokenCore(XmlWriter, SecurityToken) 方法。此方法會將記憶體內部的安全性權杖表示法轉換為 XML 表示法。如果無法轉換，則會呼叫基底類別實作。

public class CreditCardSecurityTokenSerializer : WSSecurityTokenSerializer
{
    public CreditCardSecurityTokenSerializer(SecurityTokenVersion version) : base() { }

    protected override bool CanReadTokenCore(XmlReader reader)
    {
        XmlDictionaryReader localReader = XmlDictionaryReader.CreateDictionaryReader(reader);
        if (reader == null)
        {
            throw new ArgumentNullException("reader");
        }
        if (reader.IsStartElement(Constants.CreditCardTokenName, Constants.CreditCardTokenNamespace))
        {
            return true;
        }
        return base.CanReadTokenCore(reader);
    }

    protected override SecurityToken ReadTokenCore(XmlReader reader, SecurityTokenResolver tokenResolver)
    {
        if (reader == null)
        {
            throw new ArgumentNullException("reader");
        }
        if (reader.IsStartElement(Constants.CreditCardTokenName, Constants.CreditCardTokenNamespace))
        {
            string id = reader.GetAttribute(Constants.Id, Constants.WsUtilityNamespace);

            reader.ReadStartElement();

            // Read the credit card number.
            string creditCardNumber = reader.ReadElementString(Constants.CreditCardNumberElementName, Constants.CreditCardTokenNamespace);

            // Read the expiration date.
            string expirationTimeString = reader.ReadElementString(Constants.CreditCardExpirationElementName, Constants.CreditCardTokenNamespace);
            DateTime expirationTime = XmlConvert.ToDateTime(expirationTimeString, XmlDateTimeSerializationMode.Utc);

            // Read the issuer of the credit card.
            string creditCardIssuer = reader.ReadElementString(Constants.CreditCardIssuerElementName, Constants.CreditCardTokenNamespace);
            reader.ReadEndElement();

            CreditCardInfo cardInfo = new CreditCardInfo(creditCardNumber, creditCardIssuer, expirationTime);

            return new CreditCardToken(cardInfo, id);
        }
        else
        {
            return WSSecurityTokenSerializer.DefaultInstance.ReadToken(reader, tokenResolver);
        }
    }

    protected override bool CanWriteTokenCore(SecurityToken token)
    {
        if (token is CreditCardToken)
        {
            return true;
        }
        else
        {
            return base.CanWriteTokenCore(token);
        }
    }

    protected override void WriteTokenCore(XmlWriter writer, SecurityToken token)
    {
        if (writer == null)
        {
            throw new ArgumentNullException("writer");
        }
        if (token == null)
        {
            throw new ArgumentNullException("token");
        }

        CreditCardToken c = token as CreditCardToken;
        if (c != null)
        {
            writer.WriteStartElement(Constants.CreditCardTokenPrefix, Constants.CreditCardTokenName, Constants.CreditCardTokenNamespace);
            writer.WriteAttributeString(Constants.WsUtilityPrefix, Constants.Id, Constants.WsUtilityNamespace, token.Id);
            writer.WriteElementString(Constants.CreditCardNumberElementName, Constants.CreditCardTokenNamespace, c.CardInfo.CardNumber);
            writer.WriteElementString(Constants.CreditCardExpirationElementName, Constants.CreditCardTokenNamespace, XmlConvert.ToString(c.CardInfo.ExpirationDate, XmlDateTimeSerializationMode.Utc));
            writer.WriteElementString(Constants.CreditCardIssuerElementName, Constants.CreditCardTokenNamespace, c.CardInfo.CardIssuer);
            writer.WriteEndElement();
            writer.Flush();
        }
        else
        {
            base.WriteTokenCore(writer, token);
        }
    }
}

Public Class CreditCardSecurityTokenSerializer
    Inherits WSSecurityTokenSerializer

    Public Sub New(ByVal version As SecurityTokenVersion)
        MyBase.New()
    End Sub

    Protected Overrides Function CanReadTokenCore(ByVal reader As XmlReader) As Boolean
        Dim localReader = XmlDictionaryReader.CreateDictionaryReader(reader)
        If reader Is Nothing Then
            Throw New ArgumentNullException("reader")
        End If
        If reader.IsStartElement(Constants.CreditCardTokenName, _
                                 Constants.CreditCardTokenNamespace) Then
            Return True
        End If
        Return MyBase.CanReadTokenCore(reader)
    End Function

    Protected Overrides Function ReadTokenCore(ByVal reader As XmlReader, _
                                               ByVal tokenResolver As SecurityTokenResolver) As SecurityToken
        If reader Is Nothing Then
            Throw New ArgumentNullException("reader")
        End If
        If reader.IsStartElement(Constants.CreditCardTokenName, _
                                 Constants.CreditCardTokenNamespace) Then

            Dim id = reader.GetAttribute(Constants.Id, _
                                         Constants.WsUtilityNamespace)
            reader.ReadStartElement()

            ' Read the credit card number.
            Dim creditCardNumber = reader.ReadElementString(Constants.CreditCardNumberElementName, _
                                                            Constants.CreditCardTokenNamespace)

            ' Read the expiration date.
            Dim expirationTimeString = reader.ReadElementString(Constants.CreditCardExpirationElementName, _
                                                                Constants.CreditCardTokenNamespace)
            Dim expirationTime As DateTime = XmlConvert.ToDateTime(expirationTimeString, _
                                                                   XmlDateTimeSerializationMode.Utc)

            ' Read the issuer of the credit card.
            Dim creditCardIssuer = reader.ReadElementString(Constants.CreditCardIssuerElementName, _
                                                            Constants.CreditCardTokenNamespace)
            reader.ReadEndElement()

            Dim cardInfo As New CreditCardInfo(creditCardNumber, _
                                               creditCardIssuer, _
                                               expirationTime)

            Return New CreditCardToken(cardInfo, id)
        Else
            Return WSSecurityTokenSerializer.DefaultInstance.ReadToken(reader, _
                                                                       tokenResolver)
        End If
    End Function

    Protected Overrides Function CanWriteTokenCore(ByVal token As SecurityToken) As Boolean
        If TypeOf token Is CreditCardToken Then
            Return True
        Else
            Return MyBase.CanWriteTokenCore(token)
        End If
    End Function

    Protected Overrides Sub WriteTokenCore(ByVal writer As XmlWriter, _
                                           ByVal token As SecurityToken)
        If writer Is Nothing Then
            Throw New ArgumentNullException("writer")
        End If
        If token Is Nothing Then
            Throw New ArgumentNullException("token")
        End If

        Dim c = TryCast(token, CreditCardToken)
        If c IsNot Nothing Then
            With writer
                .WriteStartElement(Constants.CreditCardTokenPrefix, _
                                   Constants.CreditCardTokenName, _
                                   Constants.CreditCardTokenNamespace)
                .WriteAttributeString(Constants.WsUtilityPrefix, _
                                      Constants.Id, _
                                      Constants.WsUtilityNamespace, _
                                      token.Id)
                .WriteElementString(Constants.CreditCardNumberElementName, _
                                    Constants.CreditCardTokenNamespace, _
                                    c.CardInfo.CardNumber)
                .WriteElementString(Constants.CreditCardExpirationElementName, _
                                    Constants.CreditCardTokenNamespace, _
                                    XmlConvert.ToString(c.CardInfo.ExpirationDate, _
                                                        XmlDateTimeSerializationMode.Utc))
                .WriteElementString(Constants.CreditCardIssuerElementName, _
                                    Constants.CreditCardTokenNamespace, _
                                    c.CardInfo.CardIssuer)
                .WriteEndElement()
                .Flush()
            End With
        Else
            MyBase.WriteTokenCore(writer, token)
        End If
    End Sub

End Class

在完成上述四個程序之後，請將自訂安全性權杖與安全性權杖提供者、驗證器、管理員，以及用戶端與服務認證，全部整合在一起。

若要將自訂安全性權杖與安全性權杖提供者整合

安全性權杖提供者會建立、修改 (視需要) 和傳回權杖的執行個體。若要建立自訂安全性權杖的自訂提供者，請建立繼承自 SecurityTokenProvider 類別的類別。下列範例會覆寫 GetTokenCore 方法以傳回 CreditCardToken 的執行個體。如需自訂安全性權杖提供者的詳細資訊，請參閱如何：建立自訂安全性權杖提供者。

class CreditCardTokenProvider : SecurityTokenProvider
{
    CreditCardInfo creditCardInfo;

    public CreditCardTokenProvider(CreditCardInfo creditCardInfo)
        : base()
    {
        if (creditCardInfo == null)
        {
            throw new ArgumentNullException("creditCardInfo");
        }
        this.creditCardInfo = creditCardInfo;
    }

    protected override SecurityToken GetTokenCore(TimeSpan timeout)
    {
        SecurityToken result = new CreditCardToken(this.creditCardInfo);
        return result;
    }
}

Friend Class CreditCardTokenProvider
    Inherits SecurityTokenProvider

    Private creditCardInfo As CreditCardInfo

    Public Sub New(ByVal creditCardInfo As CreditCardInfo)
        MyBase.New()
        If creditCardInfo Is Nothing Then
            Throw New ArgumentNullException("creditCardInfo")
        End If
        Me.creditCardInfo = creditCardInfo
    End Sub

    Protected Overrides Function GetTokenCore(ByVal timeout As TimeSpan) As SecurityToken
        Return TryCast(New CreditCardToken(Me.creditCardInfo), SecurityToken)
    End Function

End Class

若要將自訂安全性權杖與安全性權杖驗證器整合

當安全性權杖從訊息中擷取出來時，安全性權杖驗證器會驗證其內容。若要建立自訂安全性權杖的自訂驗證器，請建立繼承自 SecurityTokenAuthenticator 類別的類別。下列範例會覆寫 ValidateTokenCore 方法。如需自訂安全性權杖驗證器的詳細資訊，請參閱如何：建立自訂安全性權杖驗證器。

class CreditCardTokenAuthenticator : SecurityTokenAuthenticator
{
    string creditCardsFile;
    public CreditCardTokenAuthenticator(string creditCardsFile)
    {
        this.creditCardsFile = creditCardsFile;
    }

    protected override bool CanValidateTokenCore(SecurityToken token)
    {
        return (token is CreditCardToken);
    }

    protected override ReadOnlyCollection<IAuthorizationPolicy> ValidateTokenCore(SecurityToken token)
    {
        CreditCardToken creditCardToken = token as CreditCardToken;

        if (creditCardToken.CardInfo.ExpirationDate < DateTime.UtcNow)
        {
            throw new SecurityTokenValidationException("The credit card has expired");
        }
        if (!IsCardNumberAndExpirationValid(creditCardToken.CardInfo))
        {
            throw new SecurityTokenValidationException("Unknown or invalid credit card");
        }

        // The credit card token has only 1 claim: the card number. The issuer for the claim is the
        // credit card issuer.
        DefaultClaimSet cardIssuerClaimSet = new DefaultClaimSet(new Claim(ClaimTypes.Name, creditCardToken.CardInfo.CardIssuer, Rights.PossessProperty));
        DefaultClaimSet cardClaimSet = new DefaultClaimSet(cardIssuerClaimSet, new Claim(Constants.CreditCardNumberClaim, creditCardToken.CardInfo.CardNumber, Rights.PossessProperty));
        List<IAuthorizationPolicy> policies = new List<IAuthorizationPolicy>(1);
        policies.Add(new CreditCardTokenAuthorizationPolicy(cardClaimSet));
        return policies.AsReadOnly();
    }

    // This helper method checks whether a given credit card entry is present in the user database.
    private bool IsCardNumberAndExpirationValid(CreditCardInfo cardInfo)
    {
        try
        {
            using (StreamReader myStreamReader = new StreamReader(this.creditCardsFile))
            {
                string line = "";
                while ((line = myStreamReader.ReadLine()) != null)
                {
                    string[] splitEntry = line.Split('#');
                    if (splitEntry[0] == cardInfo.CardNumber)
                    {
                        string expirationDateString = splitEntry[1].Trim();
                        DateTime expirationDateOnFile = DateTime.Parse(expirationDateString, System.Globalization.DateTimeFormatInfo.InvariantInfo, System.Globalization.DateTimeStyles.AdjustToUniversal);
                        if (cardInfo.ExpirationDate == expirationDateOnFile)
                        {
                            string issuer = splitEntry[2];
                            return issuer.Equals(cardInfo.CardIssuer, StringComparison.InvariantCultureIgnoreCase);
                        }
                        else
                        {
                            return false;
                        }
                    }
                }
                return false;
            }
        }
        catch (Exception e)
        {
            throw new Exception("BookStoreService: Error while retrieving credit card information from User DB " + e.ToString());
        }
    }
}

Friend Class CreditCardTokenAuthenticator
    Inherits SecurityTokenAuthenticator

    Private creditCardsFile As String

    Public Sub New(ByVal creditCardsFile As String)
        Me.creditCardsFile = creditCardsFile
    End Sub

    Protected Overrides Function CanValidateTokenCore(ByVal token As SecurityToken) As Boolean
        Return (TypeOf token Is CreditCardToken)
    End Function

    Protected Overrides Function ValidateTokenCore(ByVal token As SecurityToken) As ReadOnlyCollection(Of IAuthorizationPolicy)

        Dim creditCardToken = TryCast(token, CreditCardToken)

        If creditCardToken.CardInfo.ExpirationDate < DateTime.UtcNow Then
            Throw New SecurityTokenValidationException("The credit card has expired")
        End If
        If Not IsCardNumberAndExpirationValid(creditCardToken.CardInfo) Then
            Throw New SecurityTokenValidationException("Unknown or invalid credit card")
        End If

        ' The credit card token has only 1 claim: the card number. The issuer for the claim is the
        ' credit card issuer.
        Dim cardIssuerClaimSet As New DefaultClaimSet(New Claim(ClaimTypes.Name, _
                                                                creditCardToken.CardInfo.CardIssuer, _
                                                                Rights.PossessProperty))
        Dim cardClaimSet As New DefaultClaimSet(cardIssuerClaimSet, _
                                                New Claim(Constants.CreditCardNumberClaim, _
                                                          creditCardToken.CardInfo.CardNumber, _
                                                          Rights.PossessProperty))
        Dim policies As New List(Of IAuthorizationPolicy)(1)
        policies.Add(New CreditCardTokenAuthorizationPolicy(cardClaimSet))
        Return policies.AsReadOnly()
    End Function

    ' This helper method checks whether a given credit card entry is present in the user database.
    Private Function IsCardNumberAndExpirationValid(ByVal cardInfo As CreditCardInfo) As Boolean
        Try
            Using myStreamReader As New StreamReader(Me.creditCardsFile)
                Dim line = String.Empty
                line = myStreamReader.ReadLine()
                Do While line IsNot Nothing
                    Dim splitEntry() = line.Split("#"c)
                    If splitEntry(0) = cardInfo.CardNumber Then
                        Dim expirationDateString = splitEntry(1).Trim()
                        Dim expirationDateOnFile As DateTime = DateTime.Parse(expirationDateString, _
                                                                              System.Globalization.DateTimeFormatInfo.InvariantInfo, _
                                                                              System.Globalization.DateTimeStyles.AdjustToUniversal)
                        If cardInfo.ExpirationDate = expirationDateOnFile Then
                            Dim issuer = splitEntry(2)
                            Return issuer.Equals(cardInfo.CardIssuer, _
                                                 StringComparison.InvariantCultureIgnoreCase)
                        Else
                            Return False
                        End If
                    End If
                    line = myStreamReader.ReadLine()
                Loop
                Return False
            End Using
        Catch e As Exception
            Throw New Exception("BookStoreService: Error while retrieving credit card information from User DB " & e.ToString())
        End Try
    End Function

End Class

public class CreditCardTokenAuthorizationPolicy : IAuthorizationPolicy
{
    string id;
    ClaimSet issuer;
    IEnumerable<ClaimSet> issuedClaimSets;

    public CreditCardTokenAuthorizationPolicy(ClaimSet issuedClaims)
    {
        if (issuedClaims == null)
            throw new ArgumentNullException("issuedClaims");
        this.issuer = issuedClaims.Issuer;
        this.issuedClaimSets = new ClaimSet[] { issuedClaims };
        this.id = Guid.NewGuid().ToString();
    }

    public ClaimSet Issuer { get { return this.issuer; } }

    public string Id { get { return this.id; } }

    public bool Evaluate(EvaluationContext context, ref object state)
    {
        foreach (ClaimSet issuance in this.issuedClaimSets)
        {
            context.AddClaimSet(this, issuance);
        }

        return true;
    }
}

Public Class CreditCardTokenAuthorizationPolicy
    Implements IAuthorizationPolicy

    Private _id As String
    Private _issuer As ClaimSet
    Private _issuedClaimSets As IEnumerable(Of ClaimSet)

    Public Sub New(ByVal issuedClaims As ClaimSet)
        If issuedClaims Is Nothing Then
            Throw New ArgumentNullException("issuedClaims")
        End If
        Me._issuer = issuedClaims.Issuer
        Me._issuedClaimSets = New ClaimSet() {issuedClaims}
        Me._id = Guid.NewGuid().ToString()
    End Sub

    Public ReadOnly Property Issuer() As ClaimSet Implements IAuthorizationPolicy.Issuer
        Get
            Return Me._issuer
        End Get
    End Property

    Public ReadOnly Property Id() As String Implements System.IdentityModel.Policy.IAuthorizationComponent.Id
        Get
            Return Me._id
        End Get
    End Property

    Public Function Evaluate(ByVal context As EvaluationContext, _
                             ByRef state As Object) As Boolean Implements IAuthorizationPolicy.Evaluate
        For Each issuance In Me._issuedClaimSets
            context.AddClaimSet(Me, issuance)
        Next issuance

        Return True
    End Function

End Class

若要將自訂安全性權杖與安全性權杖管理員整合

安全性權杖管理員會建立適當的權杖提供者、安全性驗證器，以及權杖序列化程式執行個體。若要建立自訂的權杖管理員，請建立繼承自 ClientCredentialsSecurityTokenManager 類別的類別。該類別的主要方法會使用 SecurityTokenRequirement 來建立適當的提供者與用戶端或服務認證。如需自訂安全性權杖管理員的詳細資訊，請參閱逐步解說：建立自訂用戶端和服務認證。

public class CreditCardClientCredentialsSecurityTokenManager : ClientCredentialsSecurityTokenManager
{
    CreditCardClientCredentials creditCardClientCredentials;

    public CreditCardClientCredentialsSecurityTokenManager(CreditCardClientCredentials creditCardClientCredentials)
        : base(creditCardClientCredentials)
    {
        this.creditCardClientCredentials = creditCardClientCredentials;
    }

    public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
    {
        if (tokenRequirement.TokenType == Constants.CreditCardTokenType)
        {
            // Handle this token for Custom.
            return new CreditCardTokenProvider(this.creditCardClientCredentials.CreditCardInfo);
        }
        else if (tokenRequirement is InitiatorServiceModelSecurityTokenRequirement)
        {
            // Return server certificate.
            if (tokenRequirement.TokenType == SecurityTokenTypes.X509Certificate)
            {
                return new X509SecurityTokenProvider(creditCardClientCredentials.ServiceCertificate.DefaultCertificate);
            }
        }
        return base.CreateSecurityTokenProvider(tokenRequirement);
    }

    public override SecurityTokenSerializer CreateSecurityTokenSerializer(SecurityTokenVersion version)
    {
        return new CreditCardSecurityTokenSerializer(version);
    }
}

Public Class CreditCardClientCredentialsSecurityTokenManager
    Inherits ClientCredentialsSecurityTokenManager

    Private creditCardClientCredentials As CreditCardClientCredentials

    Public Sub New(ByVal creditCardClientCredentials As CreditCardClientCredentials)
        MyBase.New(creditCardClientCredentials)
        Me.creditCardClientCredentials = creditCardClientCredentials
    End Sub

    Public Overrides Function CreateSecurityTokenProvider(ByVal tokenRequirement As SecurityTokenRequirement) As SecurityTokenProvider

        If tokenRequirement.TokenType = Constants.CreditCardTokenType Then
            ' Handle this token for Custom.
            Return New CreditCardTokenProvider(Me.creditCardClientCredentials.CreditCardInfo)
        ElseIf TypeOf tokenRequirement Is InitiatorServiceModelSecurityTokenRequirement Then
            ' Return server certificate.
            If tokenRequirement.TokenType = SecurityTokenTypes.X509Certificate Then
                Return New X509SecurityTokenProvider(creditCardClientCredentials.ServiceCertificate.DefaultCertificate)
            End If
        End If
        Return MyBase.CreateSecurityTokenProvider(tokenRequirement)
    End Function

    Public Overloads Overrides Function CreateSecurityTokenSerializer(ByVal version As SecurityTokenVersion) As SecurityTokenSerializer
        Return New CreditCardSecurityTokenSerializer(version)
    End Function

End Class

public class CreditCardServiceCredentialsSecurityTokenManager : ServiceCredentialsSecurityTokenManager
{
    CreditCardServiceCredentials creditCardServiceCredentials;

    public CreditCardServiceCredentialsSecurityTokenManager(CreditCardServiceCredentials creditCardServiceCredentials)
        : base(creditCardServiceCredentials)
    {
        this.creditCardServiceCredentials = creditCardServiceCredentials;
    }

    public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
    {
        if (tokenRequirement.TokenType == Constants.CreditCardTokenType)
        {
            outOfBandTokenResolver = null;
            return new CreditCardTokenAuthenticator(creditCardServiceCredentials.CreditCardDataFile);
        }
        return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
    }

    public override SecurityTokenSerializer CreateSecurityTokenSerializer(SecurityTokenVersion version)
    {
        return new CreditCardSecurityTokenSerializer(version);
    }
}

Public Class CreditCardServiceCredentialsSecurityTokenManager
    Inherits ServiceCredentialsSecurityTokenManager

    Private creditCardServiceCredentials As CreditCardServiceCredentials

    Public Sub New(ByVal creditCardServiceCredentials As CreditCardServiceCredentials)
        MyBase.New(creditCardServiceCredentials)
        Me.creditCardServiceCredentials = creditCardServiceCredentials
    End Sub

    Public Overrides Function CreateSecurityTokenAuthenticator(ByVal tokenRequirement As SecurityTokenRequirement, _
                                                               <System.Runtime.InteropServices.Out()> ByRef outOfBandTokenResolver As SecurityTokenResolver) As SecurityTokenAuthenticator
        If tokenRequirement.TokenType = Constants.CreditCardTokenType Then
            outOfBandTokenResolver = Nothing
            Return New CreditCardTokenAuthenticator(creditCardServiceCredentials.CreditCardDataFile)
        End If
        Return MyBase.CreateSecurityTokenAuthenticator(tokenRequirement, outOfBandTokenResolver)
    End Function

    Public Overrides Function CreateSecurityTokenSerializer(ByVal version As SecurityTokenVersion) As SecurityTokenSerializer
        Return New CreditCardSecurityTokenSerializer(version)
    End Function

End Class

若要將自訂安全性權杖與自訂用戶端及服務認證整合

您必須新增自訂的用戶端及服務認證才能提供應用程式的 API，以便指定自訂權杖資訊，而先前建立的自訂安全性權杖基礎結構會使用這項資訊來提供並驗證自訂安全性權杖內容。下列範例會示範執行此作業的方法。如需自訂用戶端和服務認證的詳細資訊，請參閱逐步解說：建立自訂用戶端和服務認證。

public class CreditCardClientCredentials : ClientCredentials
{
    CreditCardInfo creditCardInfo;

    public CreditCardClientCredentials(CreditCardInfo creditCardInfo)
        : base()
    {
        if (creditCardInfo == null)
        {
            throw new ArgumentNullException("creditCardInfo");
        }

        this.creditCardInfo = creditCardInfo;
    }

    public CreditCardInfo CreditCardInfo
    {
        get { return this.creditCardInfo; }
    }

    protected override ClientCredentials CloneCore()
    {
        return new CreditCardClientCredentials(this.creditCardInfo);
    }

    public override SecurityTokenManager CreateSecurityTokenManager()
    {
        return new CreditCardClientCredentialsSecurityTokenManager(this);
    }
}

Public Class CreditCardClientCredentials
    Inherits ClientCredentials

    Private _creditCardInfo As CreditCardInfo

    Public Sub New(ByVal creditCardInfo As CreditCardInfo)
        MyBase.New()
        If creditCardInfo Is Nothing Then
            Throw New ArgumentNullException("creditCardInfo")
        End If

        Me._creditCardInfo = creditCardInfo
    End Sub

    Public ReadOnly Property CreditCardInfo() As CreditCardInfo
        Get
            Return Me._creditCardInfo
        End Get
    End Property

    Protected Overrides Function CloneCore() As ClientCredentials
        Return New CreditCardClientCredentials(Me._creditCardInfo)
    End Function

    Public Overrides Function CreateSecurityTokenManager() As SecurityTokenManager
        Return New CreditCardClientCredentialsSecurityTokenManager(Me)
    End Function

End Class

public class CreditCardServiceCredentials : ServiceCredentials
{
    string creditCardFile;

    public CreditCardServiceCredentials(string creditCardFile)
        : base()
    {
        if (creditCardFile == null)
        {
            throw new ArgumentNullException("creditCardFile");
        }

        this.creditCardFile = creditCardFile;
    }

    public string CreditCardDataFile
    {
        get { return this.creditCardFile; }
    }

    protected override ServiceCredentials CloneCore()
    {
        return new CreditCardServiceCredentials(this.creditCardFile);
    }

    public override SecurityTokenManager CreateSecurityTokenManager()
    {
        return new CreditCardServiceCredentialsSecurityTokenManager(this);
    }
}

Public Class CreditCardServiceCredentials
    Inherits ServiceCredentials

    Private creditCardFile As String

    Public Sub New(ByVal creditCardFile As String)
        MyBase.New()
        If creditCardFile Is Nothing Then
            Throw New ArgumentNullException("creditCardFile")
        End If

        Me.creditCardFile = creditCardFile
    End Sub

    Public ReadOnly Property CreditCardDataFile() As String
        Get
            Return Me.creditCardFile
        End Get
    End Property

    Protected Overrides Function CloneCore() As ServiceCredentials
        Return New CreditCardServiceCredentials(Me.creditCardFile)
    End Function

    Public Overrides Function CreateSecurityTokenManager() As SecurityTokenManager
        Return New CreditCardServiceCredentialsSecurityTokenManager(Me)
    End Function

End Class

先前建立的自訂安全性權杖參數類別是用來告知 WCF 安全性架構，讓架構知道與服務進行通訊時必須使用自訂安全性權杖。下列程序會示範執行此作業的方法。

若要將自訂安全性權杖與繫結整合

您必須在 SecurityBindingElement 類別上公開的其中一個權杖參數集合指定自訂安全性權杖參數類別。下列範例會使用 SignedEncrypted 所傳回的集合。程式碼會將信用卡自訂權杖新增至每個從服務用戶端傳送的訊息，並且自動簽署並加密其內容。

public static class BindingHelper
{
    public static Binding CreateCreditCardBinding()
    {
        HttpTransportBindingElement httpTransport = new HttpTransportBindingElement();

        // The message security binding element is configured to require a credit card
        // token that is encrypted with the service's certificate.
        SymmetricSecurityBindingElement messageSecurity = new SymmetricSecurityBindingElement();
        messageSecurity.EndpointSupportingTokenParameters.SignedEncrypted.Add(new CreditCardTokenParameters());
        X509SecurityTokenParameters x509ProtectionParameters = new X509SecurityTokenParameters();
        x509ProtectionParameters.InclusionMode = SecurityTokenInclusionMode.Never;
        messageSecurity.ProtectionTokenParameters = x509ProtectionParameters;
        return new CustomBinding(messageSecurity, httpTransport);
    }
}

Public NotInheritable Class BindingHelper

    Private Sub New()
    End Sub

    Public Shared Function CreateCreditCardBinding() As Binding
        Dim httpTransport As New HttpTransportBindingElement()

        ' The message security binding element is configured to require a credit card
        ' token that is encrypted with the service's certificate. 
        Dim messageSecurity As New SymmetricSecurityBindingElement()
        messageSecurity.EndpointSupportingTokenParameters.SignedEncrypted.Add(New CreditCardTokenParameters())
        Dim x509ProtectionParameters As New X509SecurityTokenParameters()
        x509ProtectionParameters.InclusionMode = SecurityTokenInclusionMode.Never
        messageSecurity.ProtectionTokenParameters = x509ProtectionParameters
        Return New CustomBinding(messageSecurity, httpTransport)
    End Function

End Class

本主題顯示實作和使用自訂權杖所需的各種程式碼。若要查看這些程式碼片段如何相互配合的完整範例，請參閱自訂安全性權杖。

共用方式為