Question

目前，我可以通过WS-Trust端点首先使用证书凭证从STS建立安全令牌，然后在通道工厂上调用CreateChannelWithIssuedToken（）来建立具有IssuedToken的WCF通道。见How to specify a certificate as the credentials for a wsTrustChannel with Thinktecture IdentityServer

但是，不要这样做：

var securityToken = GetMeASecurityTokenFromTheSts();
var myServiceChannelFactory = new ChannelFactory<IMyService>();
myServiceChannelFactory.CreateChannelWithIssuedToken(securityToken);

理想情况下我喜欢这样做（并让安全令牌的颁发者根据传递的证书自动发出令牌）。

var myClient = new MyServiceClient();

我的问题是 - 是否可以配置类似以下内容的绑定，以指定ThinkTecture IdentityServer STS是安全令牌的颁发者？

<bindings>
  <ws2007FederationHttpBinding>
    <binding name="WS2007FederationHttpBinding">
      <security mode="TransportWithMessageCredential">
        <message issuedKeyType="BearerKey" issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
          <issuer address="https://mymachine/myidserver/issue/wstrust/mixed/certificate">
            <identity>
              <certificateReference storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" findValue="XXXXXXXXXXXXXXXXXXXXXXXXX"/>
            </identity>
          </issuer>
          <issuerMetadata address="https://mymachine/myidserver/FederationMetadata/2007-06/FederationMetadata.xml" />
          <tokenRequestParameters>
            <trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
              <trust:TokenType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</trust:TokenType>
              <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</trust:KeyType>
              <trust:Claims Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity"
                xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
                  xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />
              </trust:Claims>
              <trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/10/xml-exc-c14n#</trust:CanonicalizationAlgorithm>
              <trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
            </trust:SecondaryParameters>
          </tokenRequestParameters>
        </message>
      </security>
    </binding>
  </ws2007FederationHttpBinding>
</bindings>

如果是这样的话 - 我在配置这部分绑定时遇到了很多麻烦：

<issuer address="https://mymachine/myidserver/issue/wstrust/mixed/certificate">
    <identity>
        <certificateReference storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" findValue="XXXXXXXXXXXXXXXXXXXXXXXXX"/>
    </identity>
</issuer>

我的主要困惑之处在于：issuer配置元素似乎将绑定，行为和端点都封装在一个元素中。可以配置绑定 - 并且显然必须如上面的发行者元素抱怨没有配置绑定。但是，如何为发行者通道指定SSL证书，因为这是行为配置的事情，并且似乎没有任何方式来设置发行者端点的行为。

Answer 1

使用仅配置方法确实存在将令牌生存期绑定到代理生存期的问题。此外，您在IdentityServer中配置的域（applyTo）必须与WCF服务的物理URL匹配。两者都是IMO不实用，更推荐使用“手动”WSTrustChannelFactory方法。

即 - svcutil（或“添加服务引用”）为您创建所有必需的客户端配置。您只需要确保在WCF服务配置中指向IdentityServer的MEX端点，例如：

<bindings>
      <ws2007FederationHttpBinding>
        <binding>
          <security mode="TransportWithMessageCredential">
            <message establishSecurityContext="false"
                     issuedKeyType="BearerKey">
              <issuerMetadata address="https://identity.thinktecture.com/idsrvsample/issue/wstrust/mex" />
            </message>
          </security>
        </binding>
      </ws2007FederationHttpBinding>
    </bindings>

https://github.com/thinktecture/Thinktecture.IdentityServer.v2/blob/master/samples/MVC%20and%20WCF%20RP%20(SAML)/Web/Web.config

......并且MEF问题是固定的。

Answer 2

您可以为发卡行设置绑定配置。将在MyServiceClient行为上设置证书的使用。我没有测试过这个配置，但它可以工作。

这是您修改后的配置

<bindings>
    <ws2007FederationHttpBinding>
        <binding name="WS2007FederationHttpBinding">
            <security mode="TransportWithMessageCredential">
                <message issuedKeyType="BearerKey" issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
                    <issuer address="https://mymachine/myidserver/issue/wstrust/mixed/certificate" binding="ws2007HttpBinding" 
                  bindingConfiguration="issuerBindingConfig">
                    </issuer>
                    <issuerMetadata address="https://mymachine/myidserver/FederationMetadata/2007-06/FederationMetadata.xml" />
                    <tokenRequestParameters>
                        <trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                            <trust:TokenType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</trust:TokenType>
                            <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</trust:KeyType>
                            <trust:Claims Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity"
            xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                                <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
              xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />
                            </trust:Claims>
                            <trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/10/xml-exc-c14n#</trust:CanonicalizationAlgorithm>
                            <trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
                        </trust:SecondaryParameters>
                    </tokenRequestParameters>
                </message>
            </security>
        </binding>
    </ws2007FederationHttpBinding>

    <ws2007HttpBinding>
        <!--SWACA RAWS Client authentication binding-->
        <binding name="issuerBindingConfig">
            <security mode="TransportWithMessageCredential">
                <transport clientCredentialType="None" />
                <message clientCredentialType="Certificate" establishSecurityContext="false" />
            </security>
        </binding>
    </ws2007HttpBinding>
</bindings>


<endpointBehaviors>
    <behavior name="MyServiceClient">
        <clientCredentials supportInteractive="false">
            <clientCertificate storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" findValue="XXXXXXXXXXXXXXXXXXXXXXXXX" />
        </clientCredentials>
    </behavior>
</endpointBehaviors>

但是请记住，如果你这样做，那么每个new MyServiceClient()几乎都会从STS请求令牌。当我们在系统中使用这种方法时，我们遇到了IdentityServer的MEF threadsafety个问题。

适用于联合安全的App.Config，带有Thinktecture IdentityServer中的客户端证书

2 个答案: