Question

我在使用ADFS 2.0登录后获得无限重定向。

我的ConfigureAuth.cs就像

//defines default authentication to WSFederation
app.SetDefaultSignInAsAuthenticationType(WsFederationAuthenticationDefaults.AuthenticationType);

//Defines the MetadataAddress and realm
app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
{
      MetadataAddress = ConfigurationManager.AppSettings["ida:AdfsMetadataEndpoint"],
      Wtrealm = ConfigurationManager.AppSettings["ida:Audience"]
});

//Defines WSFederation cookie as default authentication type
 app.UseCookieAuthentication(new CookieAuthenticationOptions
{
      AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
});

我可以进入ADFS登录页面，但当它返回到我的应用程序时，它会不断要求ADFS进行有效的身份验证，在6次请求后我被ADFS阻止。

更新1

事实证明我需要指定Issuer，TokenEndpoint和证书密钥，由于某种原因，owin没有从元数据中获取这些值，所以我最终复制元数据的值并在appsettings下的webconfig中使用它们。

    public void ConfigureAuth(IAppBuilder app)
    {
           app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions { });

        app.UseWsFederationAuthentication(
            new WsFederationAuthenticationOptions
            {
                Wtrealm = ConfigurationManager.AppSettings["ida:Audience"],
                AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,

                Configuration = getWsFederationConfiguration()
            }
        );
    }

    private static WsFederationConfiguration getWsFederationConfiguration()
    {
        WsFederationConfiguration configuration = new WsFederationConfiguration
        {
            Issuer = ConfigurationManager.AppSettings["wsFederation:trustedIssuer"],
            TokenEndpoint = ConfigurationManager.AppSettings["wsFederation:issuer"],
        };

        configuration.SigningKeys.Add(new X509SecurityKey(new X509Certificate2(Convert.FromBase64String(ConfigurationManager.AppSettings["wsFederation:trustedIssuerSigningKey"]))));

        return configuration;
    }

Answer 1

如何触发身份验证？如果是通过[授权]，您是否碰巧要求特殊用户或角色？如果您请求登录用户没有的角色，您最终会弹跳。此外，您应该更改您的呼叫顺序：首先设置cookie中间件，然后设置协议。

登录后Owin WSFederation无限重定向

1 个答案: