SQL Server Service Broker --通过VPN在非域服务器之间通信

Question

如果两台SQL Server 2008实例都不在域中，但我们可以完全控制登录和凭据，那么通过Service Broker连接这两台服务器有什么好的选择吗？

我们正在考虑将此技术用于企业级数据整合，但我们的服务器运行在客户端站点，并且没有配置为任何域的成员。我们正在寻找在此环境中实现Service Broker通信的最省力的选项。

Answer 1

您可以使用证书，这是专门为类似的方案设计的Service Broker身份验证选项。参见How does Certificate based Authentication work。当端点配置了基于证书的身份验证时，手持设备将包含基于SSPI Schannel的身份验证交换(更为人所知的是SSL或TLS)。对等项使用的结果证书用于基于从证书部署派生的信任对连接进行授权。这意味着所使用的证书不会像在“https://example.com”情况下那样针对特定属性进行验证，在这种情况下，“example.com”必须在证书上使用特定的OID和可信的身份验证签名，而是如果部署了证书(即，在主数据库中找到)，则所部署证书的所有者就是身份。这允许您以安全的方式在部署中使用具有信任根的自签名证书(即。sysadmin)，而不是授权算法(即，Verisign)。这可能比您需要的信息更多:)

大意是这样的：

-------------------------------------
-- connect to server
-------------------------------------
use master;
go
create master key encryption by password = '...';
create certificate [<servername>]
  with subject = '<servername>'
  , start_date = '20100216'
  , expiry_date = '20150216';

create endpoint broker 
state = started
as tcp (listener_port = 4022)
for service_broker (authentication = certificate [<servername>]);

-- Export the public key to disk
backup certificate [<servername>]
to file = '\\someshare\<servername>.cer';

--------------------------------
-- connect to client
--------------------------------
use master;
go
create master key encryption by password = '...';
create certificate [<clientname>]
  with subject = '<clientname>'
  , start_date = '20100216'
  , expiry_date = '20150216';

create endpoint broker 
state = started
as tcp (listener_port = 4022)
for service_broker (authentication = certificate [<clientname>]);

-- Export the public key to disk
backup certificate [<clientname>]
to file = '\\someshare\<clientname>.cer';

--create an identity for server and import the server's certificate:
create login [<servername>] with password = '...';
alter login [<servername>] disable;
create user [<servername>];

create certificate [<servername>]
  authorization [<servername>]
  from file = '\\someshare\<servername>.cer';

--authorize <servername> to connect on the broker endpoint 
grant connect on endpoint::broker to [<servername>];

---------------------------------------
-- connect to the server
---------------------------------------

--create an identity for client and import the client's certificate:
create login [<clientname>] with password = '...';
alter login [<clientname>] disable;
create user [<clientname>];

create certificate [<clientname>]
  authorization [<clientname>]
  from file = '\\someshare\<clientname>.cer';

--authorize <clientname> to connect on the broker endpoint 
grant connect on endpoint::broker to [<clientname>];