Question

我们的项目中有方案，

我们有Tenant-1到Tenant-n，它们使用Restful Service S1。租户与IDP有一对一的关系。客户必须在入职时在ACS中配置的租户特定IDP的帮助下使用ACS通过Restful Service联合租户UI。

Tenant-1映射到IdP1（例如：Yahoo）租户-2映射到Idp2（例如：谷歌）

Restful Service将JavaScript作为JSON返回，JSON托管在租户的Web UI中。因此，如果租户已经使用通过他自己的应用程序特定于他的IDP登录到租户UI，那么对于从租户UI到Restful Service的任何请求，Restful服务应该基于合作伙伴信息联合到租户特定的IdP（映射）在入职过程中配置了租户（IdP）。

我在Global.asax中设置了Realm，如下所示。

public class WebApiApplication : System.Web.HttpApplication
{

    public event EventHandler RedirectingToIdentityProvider;

    public override void Init()
    {
        FederatedAuthentication.WSFederationAuthenticationModule.RedirectingToIdentityProvider += WSFederationAuthenticationModule_RedirectingToIdentityProvider;
    }

    void WSFederationAuthenticationModule_RedirectingToIdentityProvider(object sender, RedirectingToIdentityProviderEventArgs e)
    {
        Tenant tenant = GetTenantDetails(subId); // Gets the tenant information from MetaData based on subscriptionId

        if (tenant != null)
        {
            e.SignInRequestMessage.Realm = tenant.Realm + "CMS/";
        }

    }

    protected void Application_Start()
    {
        FederatedAuthentication.FederationConfigurationCreated += OnServiceConfigurationCreated;
    }

    private void OnServiceConfigurationCreated(object sender, FederationConfigurationCreatedEventArgs e)
    {

        if (tenant != null)
        {
            e.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            Uri uri = new Uri(tenant.Realm + "CMS/");
            if (!e.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
                e.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));
            e.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";
        }            
    }

此外，Realm也按每个请求级别设置，如下所示。

public class MetaDataModule : IHttpModule
{

    private static string WSFederationAuthenticationModuleName = string.Empty;

    public void Init(HttpApplication httpContextApplication)
    {
        var requestWrapper = new EventHandler(DoSyncRequestWorkToGetTenantDetails);
        httpContextApplication.BeginRequest += requestWrapper;
    }

    private static void DoSyncRequestWorkToGetTenantDetails(object sender, EventArgs e)
    {
        var httpContextApplication = (HttpApplication)sender;
        Tenant tenant = GetTenantDetails(); // Gets the tenant information from MetaData based on subscriptionId

        if (tenant != null)
        {
            WSFederationAuthenticationModule wsfed = (WSFederationAuthenticationModule)httpContextApplication.Modules["WSFederationAuthenticationModule"];
            wsfed.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            Uri uri = new Uri(tenant.Realm + "CMS/");
            if (!wsfed.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
                wsfed.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));

            wsfed.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";

            //FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            //Uri uri = new Uri(tenant.Realm + "CMS/");
            //if (!FederatedAuthentication.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
            //    FederatedAuthentication.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));

            //FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";
        }
    }

请查找在Web.config中注册的模块以及WIF配置的其余部分。

尽管为每个请求重置了Realm，但新值不会被分配。

客户不希望他们的租户从他们的端部实现任何身份验证或联合相关的代码，以便工作。

如果您能在被动联合会的帮助下考虑解决此问题，请告诉我。

Answer 1

您应该在Global.asax中的Application_AuthenticateRequest方法中自定义域。看一下这个link。

在运行时为Web服务设置领域和颁发者（windows azure ACS）

1 个答案: