SQL Server Service Broker-通过VPN在非域服务器之间通信

您使用证书,这是专门为类似您的场景设计的ServiceBroker身份验证选项。见 How does Certificate based Authentication work .当端点配置为基于证书的身份验证时,handhsake将包含一个基于sspi-schannel的身份验证交换(通常称为ssl或tls)。对等方使用的结果证书用于根据从证书部署派生的信任来授权连接。这意味着所使用的证书没有针对“中”这样的特定属性进行验证。 https://example.com 'case,其中'example.com'必须在证书上有一个特定的OID和一个可信的授权签名,但是如果部署了证书(即在master数据库中找到),则部署的证书的所有者是标识。这允许您以安全的方式使用自签名证书,并在部署中使用信任根(即sysadmin),而不是授权人(即verisign)。这可能比您需要的信息更多:)

其要点如下:

-------------------------------------
-- connect to server
-------------------------------------
use master;
go
create master key encryption by password = '...';
create certificate [<servername>]
  with subject = '<servername>'
  , start_date = '20100216'
  , expiry_date = '20150216';

create endpoint broker 
state = started
as tcp (listener_port = 4022)
for service_broker (authentication = certificate [<servername>]);

-- Export the public key to disk
backup certificate [<servername>]
to file = '\\someshare\<servername>.cer';

--------------------------------
-- connect to client
--------------------------------
use master;
go
create master key encryption by password = '...';
create certificate [<clientname>]
  with subject = '<clientname>'
  , start_date = '20100216'
  , expiry_date = '20150216';

create endpoint broker 
state = started
as tcp (listener_port = 4022)
for service_broker (authentication = certificate [<clientname>]);

-- Export the public key to disk
backup certificate [<clientname>]
to file = '\\someshare\<clientname>.cer';

--create an identity for server and import the server's certificate:
create login [<servername>] with password = '...';
alter login [<servername>] disable;
create user [<servername>];

create certificate [<servername>]
  authorization [<servername>]
  from file = '\\someshare\<servername>.cer';

--authorize <servername> to connect on the broker endpoint 
grant connect on endpoint::broker to [<servername>];

---------------------------------------
-- connect to the server
---------------------------------------

--create an identity for client and import the client's certificate:
create login [<clientname>] with password = '...';
alter login [<clientname>] disable;
create user [<clientname>];

create certificate [<clientname>]
  authorization [<clientname>]
  from file = '\\someshare\<clientname>.cer';

--authorize <clientname> to connect on the broker endpoint 
grant connect on endpoint::broker to [<clientname>];