Question

我正在WIF中处理包含EncryptedAssertion的SAML2令牌。标记不包含“主题标识符键”扩展属性，因此WIF SecurityTokenHandler在尝试从LocalMachineStore / Personal获取正确的X509证书时失败。

问题显然是用于加密令牌的证书不包含SKI扩展，当然令牌生成代码（Java）似乎并不需要它。为了避免必须修改生成代码，有没有办法让WIF SecuityTokenResolver不检查SKI收到的令牌，而只是直接使用本地商店证书来解密令牌？

Answer 1

最后，我刚刚实现了一个自定义的SecurityTokenResolver并实现了TryResolveSecurityKeyCore方法。

以下是代码：

public class mySaml2SSOSecurityTokenResolver : SecurityTokenResolver
{
    List<SecurityToken> _tokens;

    public PortalSSOSecurityTokenResolver(List<SecurityToken> tokens)
    {
        _tokens = tokens;
    }
    protected override bool TryResolveSecurityKeyCore(System.IdentityModel.Tokens.SecurityKeyIdentifierClause keyIdentifierClause, out System.IdentityModel.Tokens.SecurityKey key)
    {
        var token = _tokens[0] as X509SecurityToken;

        var myCert = token.Certificate;

        key = null;

        try
        {

            var ekec = keyIdentifierClause as EncryptedKeyIdentifierClause;

            if (ekec != null)
            {

                switch (ekec.EncryptionMethod)
                {

                    case "http://www.w3.org/2001/04/xmlenc#rsa-1_5":
                        {
                            var encKey = ekec.GetEncryptedKey();

                            var rsa = myCert.PrivateKey as RSACryptoServiceProvider;

                            var decKey = rsa.Decrypt(encKey, false);

                            key = new InMemorySymmetricSecurityKey(decKey);

                            return true;

                        }

                }

                var data = ekec.GetEncryptedKey();

                var id = ekec.EncryptingKeyIdentifier;

            }

        }

        catch (Exception ex)
        {
           // Do something here            }

            return true;

    }

    protected override bool TryResolveTokenCore(System.IdentityModel.Tokens.SecurityKeyIdentifierClause keyIdentifierClause, out System.IdentityModel.Tokens.SecurityToken token)
    {
        throw new NotImplementedException();
    }

    protected override bool TryResolveTokenCore(System.IdentityModel.Tokens.SecurityKeyIdentifier keyIdentifier, out System.IdentityModel.Tokens.SecurityToken token)
    {
        throw new NotImplementedException();
    }
}

}

如何在SecurityTokenResolver中禁用主题密钥标识符

1 个答案: