Question

我正在尝试将2个adfs实例链接在一起。我们有一个受一个ADFS保护的应用程序和另一个也使用ADFS保护应用程序的AD中的用户。现在，我尝试将一个ADFS保护的应用程序授予其他ADFS中的用户。

在AD中具有用户的ADFS中，我设置了一个新的RelyingParty，它是另一个ADFS实例。

在保护应用程序的ADFS中，我设置了一个声明提供程序信任，我通过指向具有Active Directory中用户的ADFS实例的元数据来完成此操作。这似乎有效。

现在，当我尝试访问受保护的应用程序时，我收到了SSO证书的证书错误，我点击了那些然后它将我弹回RP ADFS并显示一个页面，让我可以选择AD或我的ID ADFS实例。我选择刚刚设置的ID ADFS，单击“继续”，它会将我弹回登录页面。登录后，它会将我反弹回RP ADFS服务器，然后出现错误，带有参考编号。当我在事件日志中查找参考号时，我看到2或3个错误。

第一个是关于撤销清单

尝试为声明提供程序信任版建立证书链时发生错误＆＃39; http://dev-sso.xxxxxxx.com/adfs/services/trust＆＃39;由thumbprint＆＃54; 54xxxxxxxxxxxxxxxxxxxxxxE28C9A57481＆＃39;识别的证书。可能的原因是证书已被撤销，证书链无法按照声明提供商信任的签名证书吊销设置或证书不在其有效期内的情况进行验证。

第二个是

The Federation Service encountered an error while processing the WS-Trust request. 

Request type: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue 

Additional Data 

Exception details: 

Microsoft.IdentityModel.Protocols.XmlSignature.SignatureVerificationFailedException: ID4037: The key needed to verify the signature could not be resolved from the following security key identifier 'SecurityKeyIdentifier

    (

    IsReadOnly = False,

    Count = 1,

    Clause[0] = Microsoft.IdentityServer.Tokens.MSISSecurityKeyIdentifierClause

    )

'. Ensure that the SecurityTokenResolver is populated with the required key.

   at Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.ResolveSigningCredentials()

   at Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.OnEndOfRootElement()

   at Microsoft.IdentityModel.Protocols.XmlSignature.EnvelopedSignatureReader.Read()

   at System.Xml.XmlReader.ReadEndElement()

   at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ReadAssertion(XmlReader reader)

   at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ReadToken(XmlReader reader)

   at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader)

   at Microsoft.IdentityModel.Tokens.SecurityTokenElement.ReadSecurityToken(XmlElement securityTokenXml, SecurityTokenHandlerCollection securityTokenHandlers)

   at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSecurityToken()

   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)

   at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.BeginGetScope(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state)

   at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.BeginIssue(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state)

   at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.DispatchRequestAsyncResult..ctor(DispatchContext dispatchContext, AsyncCallback asyncCallback, Object asyncState)

   at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.BeginDispatchRequest(DispatchContext dispatchContext, AsyncCallback asyncCallback, Object asyncState)

   at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.ProcessCoreAsyncResult..ctor(WSTrustServiceContract contract, DispatchContext dispatchContext, MessageVersion messageVersion, WSTrustResponseSerializer responseSerializer, WSTrustSerializationContext serializationContext, AsyncCallback asyncCallback, Object asyncState)

   at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.BeginProcessCore(Message requestMessage, WSTrustRequestSerializer requestSerializer, WSTrustResponseSerializer responseSerializer, String requestAction, String responseAction, String trustNamespace, AsyncCallback callback, Object state)

Microsoft.IdentityModel.Protocols.XmlSignature.SignatureVerificationFailedException: ID4037: The key needed to verify the signature could not be resolved from the following security key identifier 'SecurityKeyIdentifier

Microsoft.IdentityModel.Protocols.XmlSignature.SignatureVerificationFailedException: ID4037: The key needed to verify the signature could not be resolved from the following security key identifier 'SecurityKeyIdentifier

Answer 1

我决定禁用撤销列表检查。我认为这个问题是一个代理或防火墙，在生产中我们将拥有真正的证书，所以我认为这不会是一个问题。
所以不是答案，但足以继续前进。

如何让一个ADFS信任另一个ADFS

1 个答案: