Question

有没有办法为应用程序池标识用户（已配置的用户）获取SAML令牌？

当我们配置应用程序池时，在％systemroot％\ System32 \ Inetsrv \ config path下的applicationHost.config中存储配置条目（用户名和密码）。

当应用程序启动时，它会选择用户名和加密密码进行身份验证。身份验证成功后，它是否会遵循基于令牌的身份验证进行后续呼叫，还是始终遵循基本身份验证？

如果基于令牌，那么在第一次响应之后如何获取应用程序池标识用户的SAML令牌？

如果有任何链接，请告诉我。

提前致谢。

Answer 1

答案1：通过使用Adal流为登录用户获取Jwt令牌，

if (!AdfsConfiguration.IsInitialized) throw new SecurityException(Constants.AdfsConfigurationInitilizationExceptionMessage);
if (string.IsNullOrEmpty(AdfsConfiguration.AdfsAuthorityUrl)) throw new SecurityException(Constants.AdfsConfigurationAdfsAuthorityUrlInitilizationExceptionMessage);

try
{
    var authenticationContext = new AuthenticationContext(string.Format(AdfsConfiguration.AdfsAuthorityUrl, AdfsConfiguration.AdfsInstance, AdfsConfiguration.Resource), false);

    var asyncRequest = authenticationContext.AcquireTokenAsync(AdfsConfiguration.Resource, AdfsConfiguration.ClientId, new Uri(AdfsConfiguration.RedirectUri), new PlatformParameters(PromptBehavior.Auto));
    var accessToken = asyncRequest.Result.AccessToken;
    return accessToken;
}
catch (Exception exp)
{
    var additionalInfo = $" additionalInfo : [authenticationContext : {string.Format(AdfsConfiguration.AdfsAuthorityUrl, AdfsConfiguration.AdfsInstance, AdfsConfiguration.Resource)}]";
    throw new SecurityException($"AdfsAuthorization.GetAdfsOAuthJwtAccessTokenForWinAppUserUsingAdal is failed, {additionalInfo}", exp);
}

Answer 2

Ans 2：通过Auth代码流为登录用户或应用程序池标识用户获取Jwt令牌。

第1步：从Adfs服务器获取验证码

        var authUrl = string.Format(AdfsConfiguration.AdfsAuthUrl, AdfsConfiguration.AdfsInstance, AdfsConfiguration.ClientId, AdfsConfiguration.Resource, AdfsConfiguration.UrlEncodedRedirectUri);
        var authCode = "";

        try
        {
            do
            {
                var result = await Client.GetAsync(authUrl);
                await result.Content.ReadAsStringAsync();
                IEnumerable<string> values;
                if (result.Headers.TryGetValues("location", out values))
                {
                    foreach (string s in values)
                    {
                        if (s.Contains("code="))
                        {
                            authUrl = "";
                            authCode = s.Substring(s.IndexOf("code=", StringComparison.Ordinal) + 5);
                        }
                        else
                        {
                            authUrl = s;
                        }
                    }
                }
                else
                {
                    authUrl = "";
                }
            } while (!string.IsNullOrEmpty(authUrl));

            return authCode;
        }
        catch (Exception exp)
        {
            var additionalInfo = $"additionalInfo : [authUrl: {authUrl}]";
            throw new SecurityException($"AdfsAuthorization.GetAuthCodeForWinAppUserAsync is failed, {additionalInfo}", exp);
        }

步骤2：传递Auth代码以从Adfs服务器获取jwt令牌

        if (!AdfsConfiguration.IsInitialized) throw new SecurityException(Constants.AdfsConfigurationInitilizationExceptionMessage);

        var client = new WebClient();
        try
        {
            if (AdfsConfiguration.UseProxy == "Y")
            {
                var proxyObject = new WebProxy("Proxy", 80) { Credentials = CredentialCache.DefaultNetworkCredentials };
                client.Proxy = proxyObject;
            }

            //Uri address = new Uri(String.Format("https://{0}/adfs/oauth2/token/", AdfsInstance));
            Uri address = new Uri(string.Format(AdfsConfiguration.AdfsTokenServiceUrl, AdfsConfiguration.AdfsInstance));

            Uri redirectAddress = new Uri(AdfsConfiguration.RedirectUri);

            NameValueCollection values = new NameValueCollection
            {
                {"client_id", AdfsConfiguration.ClientId},
                {"grant_type", "authorization_code"},
                {"code", code},
                {"redirect_uri", redirectAddress.ToString()}
            };

            byte[] responseBytes = client.UploadValues(address, "POST", values);

            string response = System.Text.Encoding.UTF8.GetString(responseBytes);

            return response;

        }
        catch (Exception exp)
        {
            var additionalInfo = $" additionalInfo : [address: {string.Format(AdfsConfiguration.AdfsTokenServiceUrl, AdfsConfiguration.AdfsInstance) }, redirect Uri :{AdfsConfiguration.RedirectUri}]";
            throw new SecurityException($"AdfsAuthorization.GetAdfsOAuthTokenByAuthCode is failed, {additionalInfo}", exp);
        }
        finally
        {
            client.Dispose();
        }

Answer 3

获取应用程序池标识的SAML断言或登录用户：

        string rpLoginUrl = string.Format(SapConfiguration.AdfsSignInUrl, SapConfiguration.AdfsInstance, HttpUtility.UrlEncode(GetSapTokenServiceUrl));
        string htmlContent;

        try
        {
            do
            {
                var result = await Client.GetAsync(rpLoginUrl);
                htmlContent = await result.Content.ReadAsStringAsync();
                IEnumerable<string> values;
                if (result.Headers.TryGetValues("location", out values))
                {
                    foreach (string s in values)
                    {
                        if (s.StartsWith("/"))
                        {
                            rpLoginUrl = rpLoginUrl.Substring(0, rpLoginUrl.IndexOf("/adfs/ls", StringComparison.Ordinal)) + s;
                        }
                        else
                        {
                            rpLoginUrl = s;
                        }
                    }
                }
                else
                {
                    rpLoginUrl = "";
                }
            } while (!string.IsNullOrEmpty(rpLoginUrl));
        }
        catch (Exception exp)
        {
            var additionalInfo = $" additionalInfo : [rpLoginUrl: {rpLoginUrl}]";
            throw new SecurityException($"SapAuthorization.GetSamlResponseForProcessIdentityAsync is failed, {additionalInfo}", exp);
        }

        var reg = new Regex("SAMLResponse\\W+value\\=\\\"([^\\\"]+)\\\"");
        var matches = reg.Matches(htmlContent);
        string lastMatch = null;
        foreach (Match m in matches)
        {
            lastMatch = m.Groups[1].Value;
        }

        return lastMatch;

如何从应用程序池标识中获取SAML令牌（针对已配置的用户）？

3 个答案: