正如我在another question中所描述的,我构建了一个Web服务,该服务将使用用户名/密码并基于这些凭据在ADFS2中对用户(移动应用程序)进行身份验证。我的Web服务在ADFS上配置为RP。 ADFS发布SAML 2.0令牌。
以下是网络方法的代码:
public class MobileAuthService : IMobileAuthService
{
private const string adfsBaseAddress = @"https://<my_adfs_hostname>/adfs/services/";
private const string endpointSuffix = @"trust/13/issuedtokenmixedsymmetricbasic256";
public string AuthenticateUser(string username, string password)
{
var binding = new WS2007HttpBinding(SecurityMode.Message);
binding.Security.Message.EstablishSecurityContext = false;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
binding.Security.Mode = SecurityMode.TransportWithMessageCredential;
var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(adfsBaseAddress + endpointSuffix))
{
TrustVersion = TrustVersion.WSTrust13
};
trustChannelFactory.Credentials.UserName.UserName = username;
trustChannelFactory.Credentials.UserName.Password = password;
var tokenClient = (WSTrustChannel)trustChannelFactory.CreateChannel();
var rst = new RequestSecurityToken(RequestTypes.Issue, KeyTypes.Symmetric);
var token = tokenClient.Issue(rst);
// do some token-related stuff
return token.Id;
}
}
当我尝试运行它时(从浏览器获取GET调用,因为它为此端点配置了web http绑定),我得到以下异常:
System.ServiceModel.Security.MessageSecurityException - "An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail."
内部异常:
System.ServiceModel.FaultException - "An error occurred when verifying security for the message."
我猜这与响应签名或证书有关,但我不知道如何克服这个问题,因为我是WIF的新手。
答案 0 :(得分:5)
我设法(部分)解决了这个问题。我在代码中改变了一些东西,但问题似乎与:
有关/trust/13/usernamemixed
Bearer
时,它开始返回SAML令牌这是我最近的版本:
public class MobileAuthService : IMobileAuthService
{
private const string stsEndpointAddress = @"https://<my_adfs_hostname>/adfs/services/trust/13/usernamemixed";
private const string relyingPartyAddress =
"https://<my_service_addr>/Auth.svc";
public string AuthenticateUser(string username, string password)
{
var binding = new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential)
{
ClientCredentialType = HttpClientCredentialType.None
};
var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(stsEndpointAddress))
{
TrustVersion = TrustVersion.WSTrust13
};
var channelCredentials = trustChannelFactory.Credentials;
channelCredentials.UserName.UserName = username;
channelCredentials.UserName.Password = password;
channelCredentials.SupportInteractive = false;
var tokenClient = (WSTrustChannel)trustChannelFactory.CreateChannel();
var rst = new RequestSecurityToken(RequestTypes.Issue, KeyTypes.Bearer)
{
AppliesTo = new EndpointReference(relyingPartyAddress),
ReplyTo = relyingPartyAddress,
TokenType = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
};
// to some token-related stuff (like transformations etc...)
}
}
我希望这可以帮助那些最终遇到类似问题的人。