Question

我有一个用c＃/。NET编写的Web服务，该服务将未经身份验证的用户重定向到WS Federation身份提供程序，然后使用具有该用户角色的SAML令牌将其重定向回到我的Web服务。这是根据被动WS联合身份验证规范-http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html#_Toc223175008

有了这个，我得到了一个请求，该请求的结果设置为令牌。在我的代码中，我有一个字符串 wresult是xml文档的字符串。我所知道的是领域，身份提供者的指纹，wctx（如果已发送）。

安全令牌是此处描述的标准WS-Trust令牌： http://specs.xmlsoap.org/ws/2005/02/trust/WS-Trust.pdf

我想要获取的是SecurityToken，最后是仅通过 string 的那个用户的IPrincipal，它是XML文档/安全令牌。

该字符串的示例为（混淆了一些内容）。

<?xml version="1.0"?>
<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
  <t:Lifetime>
    <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2018-09-14T13:40:25.164Z</wsu:Created>
    <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2018-09-14T14:40:25.164Z</wsu:Expires>
  </t:Lifetime>
  <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
    <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
      <wsa:Address>https://localhost:44366/</wsa:Address>
    </wsa:EndpointReference>
  </wsp:AppliesTo>
  <t:RequestedSecurityToken>
    <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" MajorVersion="1" MinorVersion="1" AssertionID="_e1580903-02ac-453d-a157-ae27c8614cc9" Issuer="http://adfs.ORGANISATION.com/adfs/services/trust" IssueInstant="2018-09-14T13:40:25.164Z">
      <saml:Conditions NotBefore="2018-09-14T13:40:25.164Z" NotOnOrAfter="2018-09-14T14:40:25.164Z">
        <saml:AudienceRestrictionCondition>
          <saml:Audience>https://localhost:44366/</saml:Audience>
        </saml:AudienceRestrictionCondition>
      </saml:Conditions>
      <saml:AttributeStatement>
        <saml:Subject>
          <saml:SubjectConfirmation>
            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
          </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Attribute AttributeName="emailaddress" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
          <saml:AttributeValue>person@stuff.com</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute AttributeName="givenname" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
          <saml:AttributeValue>Jeff</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute AttributeName="surname" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
          <saml:AttributeValue>Mandelson</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute AttributeName="windowsaccountname" AttributeNamespace="http://schemas.microsoft.com/ws/2008/06/identity/claims">
          <saml:AttributeValue>jeff.mandelson</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute AttributeName="role" AttributeNamespace="http://schemas.microsoft.com/ws/2008/06/identity/claims">
          <saml:AttributeValue>Stuff\Domain Users</saml:AttributeValue>
          <saml:AttributeValue>Stuff\DevTeam</saml:AttributeValue>
          <saml:AttributeValue>Stuff\RDS-MSSQLDEV-RW</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute AttributeName="upn" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
          <saml:AttributeValue>stuff@local.com</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute AttributeName="name" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
          <saml:AttributeValue>Jeff Mandelson</saml:AttributeValue>
        </saml:Attribute>
      </saml:AttributeStatement>
      <saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" AuthenticationInstant="2018-09-14T11:59:16.147Z">
        <saml:Subject>
          <saml:SubjectConfirmation>
            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
          </saml:SubjectConfirmation>
        </saml:Subject>
      </saml:AuthenticationStatement>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
          <ds:Reference URI="#_e1580903-02ac-453d-a157-ae27c8614cc9">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
            <ds:DigestValue>a_digest_value_removed</ds:DigestValue>
          </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>signature</ds:SignatureValue>
        <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
          <X509Data>
            <X509Certificate>certificate</X509Certificate>
          </X509Data>
        </KeyInfo>
      </ds:Signature>
    </saml:Assertion>
  </t:RequestedSecurityToken>
  <t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType>
  <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
  <t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
</t:RequestSecurityTokenResponse>

我尝试使用内置方法，例如但是，WSFederationAuthenticationModule似乎有问题，除非您使用System.Web.Request。内置的.NET / C＃函数会更好！

Answer 1

解决方案是将令牌视为常规XMLDsig签名的XML-声明节点已签名，并且签名的引用指向它。代码很简单，但是有趣的是必须继承SignedXml类，使签名验证器遵循AssertionID属性（默认约定是，已签名节点的id属性仅称为ID和默认的验证程序将不会找到ID属性不同的节点。

public class SamlSignedXml : SignedXml
{
    public SamlSignedXml(XmlElement e) : base(e) { }

    public override XmlElement GetIdElement(XmlDocument document, string idValue)
    {
        XmlNamespaceManager mgr = new XmlNamespaceManager(document.NameTable);
        mgr.AddNamespace("trust", "http://docs.oasis-open.org/ws-sx/ws-trust/200512");
        mgr.AddNamespace("wsu", "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd");
        mgr.AddNamespace("saml", "urn:oasis:names:tc:SAML:1.0:assertion");

        XmlElement assertionNode = 
               (XmlElement)document.SelectSingleNode("//trust:RequestSecurityTokenResponseCollection/trust:RequestSecurityTokenResponse/"+
                                                     "trust:RequestedSecurityToken/saml:Assertion", mgr);

        if (assertionNode.Attributes["AssertionID"] != null &&
            string.Equals(assertionNode.Attributes["AssertionID"].Value, idValue, StringComparison.InvariantCultureIgnoreCase)
            )
            return assertionNode;

        return null;
    }
}

请注意，XPath假定令牌的根中有RequestSecurityTokenResponseCollection，请确保您的令牌遵循此约定（如果是单个令牌，则可能会丢失集合节点，并且令牌的根可能只是{ {1}}，相应地更新代码。

然后输入验证码

RequestSecurityTokenResponse

通过一些小的调整，您应该可以做自己想做的事。

顺便说一句。大部分答案都是从我的博客条目中复制的

https://www.wiktorzychla.com/2018/09/parsing-saml-11-ws-federation-tokens.html

记录了我们在其中一个应用程序内部使用的方法。我打算进行一段时间的输入，您的问题只是我需要的触发条件。

Answer 2

另一种方法是使用IdentityModel SamlTokenVerifier和Parser：

public static bool AuthenticateXmlToken(String wresult)
        {


            String pstrXML = wresult;

            // write it down 
            File.WriteAllText("C:\\Users\\USER\\Downloads\\asdf4.xml", wresult);

            // extract the SAML Assertion
            XmlReader reader = XmlReader.Create(new StringReader(pstrXML));
            reader.ReadToFollowing("Assertion", "urn:oasis:names:tc:SAML:1.0:assertion");

            // saml requirements 
            SamlSecurityTokenRequirement pRequirements = new SamlSecurityTokenRequirement();
            pRequirements.CertificateValidator = new CertificateValidator();

            SecurityTokenHandlerConfiguration pConfig = new SecurityTokenHandlerConfiguration();
            pConfig.AudienceRestriction = new AudienceRestriction(AudienceUriMode.Never);
            pConfig.IssuerNameRegistry = new IssuerNames();

            //pRequirements.ValidateAudienceRestriction()
            SamlSecurityTokenHandler pHandler = new SamlSecurityTokenHandler(pRequirements);
            pHandler.Configuration = pConfig;


            SecurityTokenHandlerCollection tokenHandlerCollection = SecurityTokenHandlerCollection.CreateDefaultSecurityTokenHandlerCollection();
            SamlSecurityToken token = (SamlSecurityToken)pHandler.ReadToken(reader.ReadSubtree());

            ReadOnlyCollection<ClaimsIdentity> pClaims = pHandler.ValidateToken(token);

            return pClaims.Count > 0;
        }


        public class IssuerNames : IssuerNameRegistry
        {
            public override string GetIssuerName(SecurityToken securityToken)
            {

                return "Issuer";
                throw new NotImplementedException();
            }
        }


        public class CertificateValidator : X509CertificateValidator
        {
            public override void Validate(X509Certificate2 certificate)
            {
                if (certificate == null)
                {
                    throw new Exception("certificate is null");
                }

                if (certificate.Thumbprint.ToLower() != "mythumprint")
                {
                    throw new Exception("X509 certficate is signed with the wrong public key!");
                }
            }
        }

解析并验证WS Trust XML令牌

2 个答案: