使用從STS分配的令牌來調用WCF服務

Question

我一直盯着這一整天都無濟於事，而且我沒有想法。 IP-STS處理登錄信息，然後將其傳遞給RP-STS，後者用聲明填充標記，然後登錄到網站上。這工作正常。我在IP-STS上有一些WCF功能，例如更改密碼/重置密碼並需要訪問它們。已經閱讀我應該能夠將已分配的令牌發送到WCF以確保用戶通過身份驗證。從我可以看到它發送令牌但不正確，也不是我想要的方式，因爲它似乎現在需要用戶名。

理想情況下我希望它分配給用戶的令牌，而不必重新請求或重新創建任何東西，明確地不需要用戶名/密碼。

我目前收到的錯誤是： 從對方收到了一個不安全或錯誤安全的錯誤。查看故障代碼和細節的內部FaultException。

詳細信息： 該消息無法處理。這很可能是因爲操作'http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue'不正確，或者因爲消息包含無效或過期的安全上下文令牌，或者由於存在不匹配綁定之間。如果服務由於不活動而中止通道，則安全上下文令牌將無效。爲防止服務過早地中止空閒會話，會增加服務端點綁定的接收超時。

這是我的網頁配置中的相關位。

客戶端的web.config

---

<system.serviceModel> 
<bindings> 
    <customBinding> 
    <binding name="UsernameBinding">   <security authenticationMode="UserNameForCertificate"     requireSecurityContextCancellation ="false"     requireSignatureConfirmation="false"     messageProtectionOrder ="SignBeforeEncryptAndEncryptSignature"     requireDerivedKeys="true"> 
     </security> 
     <httpTransport/> 
    </binding> 
    </customBinding> 
    <wsFederationHttpBinding> 
    <binding name="HTTPEndpoint" closeTimeout="00:10:00" openTimeout="00:10:00" 
     receiveTimeout="00:10:00" sendTimeout="00:10:00" bypassProxyOnLocal="false" 
     transactionFlow="false" hostNameComparisonMode="StrongWildcard" 
     maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" 
     textEncoding="utf-8" useDefaultWebProxy="true"> 
     <security mode="Message"> 
     <message issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" negotiateServiceCredential="false">    <claimTypeRequirements> 

      <add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="false" /> 
      </claimTypeRequirements> 

      <issuer address="http://localhost:13422/MembershipService" bindingConfiguration="UsernameBinding" binding="customBinding"> 
      <identity> 
       <certificateReference findValue="STSTestCert" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="TrustedPeople" /> 
      </identity> 
      </issuer> 
     </message> 

     </security> 
    </binding> 
    </wsFederationHttpBinding> 
</bindings> 

<behaviors> 
    <!-- Credentials configuration --> 
    <endpointBehaviors> 
    <behavior name="ServiceBehavior"> 
     <clientCredentials> 

     <clientCertificate findValue="STSTestCert" storeLocation="CurrentUser" storeName="TrustedPeople" x509FindType="FindBySubjectName" /> 
     <serviceCertificate> 
      <defaultCertificate findValue="STSTestCert" storeLocation="CurrentUser" storeName="TrustedPeople" x509FindType="FindBySubjectName"/> 
      <authentication certificateValidationMode="PeerOrChainTrust" /> 
     </serviceCertificate> 

     </clientCredentials> 
    </behavior> 
    </endpointBehaviors> 
</behaviors> 

<client> 
    <endpoint address="http://localhost:13422/MembershipService" 
    binding="wsFederationHttpBinding" bindingConfiguration="HTTPEndpoint" 
    contract="MembershipService.IAccountMembershipService" name="HTTPEndpoint" behaviorConfiguration="ServiceBehavior"> 
    <identity> 
     <dns value="localhost"/> 
    </identity> 
    </endpoint> 
</client> 

---

服務側：

<system.serviceModel> 

<serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true"> 
    <serviceActivations> 
    <add relativeAddress="IAccountMembershipService.svc" service="AccountMembershipService" factory="System.ServiceModel.Activation.WebServiceHostFactory" /> 
    </serviceActivations> 
</serviceHostingEnvironment> 

<bindings> 
    <wsHttpBinding> 
    <binding name="federationBinding" receiveTimeout="00:10:00" sendTimeout="00:10:00" closeTimeout="00:10:00" openTimeout="00:10:00"> 

     <security mode="Message"> 
     <message negotiateServiceCredential="true" /> 
     </security> 
    </binding> 

    </wsHttpBinding> 
    <wsFederationHttpBinding> 
    <binding name="federationBinding" closeTimeout="00:10:00" openTimeout="00:10:00" 
     receiveTimeout="00:10:00" sendTimeout="00:10:00" bypassProxyOnLocal="false" 
     transactionFlow="false" hostNameComparisonMode="StrongWildcard" 
     maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" 
     textEncoding="utf-8" useDefaultWebProxy="true"> 

     <security mode="Message"> 
     <message issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" negotiateServiceCredential="false"> 
      <claimTypeRequirements> 

      <add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="false" /> 
      </claimTypeRequirements> 

      <issuer address="http://localhost:13422/MembershipService" bindingConfiguration="UsernameBinding" binding="customBinding"> 
      <identity> 
       <certificateReference findValue="STSTestCert" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="TrustedPeople" /> 
      </identity> 
      </issuer> 
     </message> 
     </security> 
    </binding> 
    </wsFederationHttpBinding> 
</bindings> 


<behaviors> 
    <serviceBehaviors> 
    <behavior name="serviceBehavior"> 
     <serviceMetadata httpGetEnabled="true" /> 

     <serviceCredentials> 
     <serviceCertificate findValue="CN=STSTestCert" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName"/> 

     </serviceCredentials> 
    </behavior> 
    </serviceBehaviors> 
</behaviors> 

<extensions> 
    <behaviorExtensions> 
    <!-- This behavior extension will enable the service host to be Claims aware --> 
    <add name="federatedServiceHostConfiguration" type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=0.6.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> 
    </behaviorExtensions> 
</extensions> 

<services> 
    <service behaviorConfiguration="serviceBehavior" name="STS.IP.Models.AccountMembershipService"> 
    <endpoint binding="wsFederationHttpBinding" bindingConfiguration="federationBinding" name="HTTPEndpoint" contract="STS.IP.Infrastructure.IAccountMembershipService" > 
     <identity> 
     <dns value="localhost"/> 
     </identity> 
    </endpoint> 
    <!-- <endpoint binding="wsHttpBinding" bindingConfiguration="" name="HTTPEndpoint" contract="Aurora.WCFIsAlive.IIsAlive" />--> 

    </service> 
</services> 

抱歉大量粘貼，但希望有人能夠發現我的錯誤！ 我剛剛接近錯誤的方式嗎？

Answer 1

我不知道這是否有任何幫助，但它可能有點相關...您可以重複使用已發佈的令牌，這是我之前做過的。我曾經說過的scenerio說一個ASP.NET站點或WCF服務是WIF安全的，但是然後ASP.NET站點或WCF服務需要調用另一個需要SAML令牌/ WIF的服務，等等。如果你使用了令牌將WIF設置爲使用引導。只要第二個Web服務信任相同的STS。

http://msdn.microsoft.com/en-us/library/ee517256.aspx#_bootstrap

的配置下的設置：

<microsoft.IdentityModel><service><securityTokenHandlers>: 

這個值：

<securityTokenHandlerConfiguration saveBootstrapTokens="true" /> 

Answer 2

Web站點（即正在工作的依賴方）和IP-STS上的WCF端點是2個不同的應用程序。你不能重複使用相同的標記。您應該獲得IP-STS服務的新令牌（例如更新密碼等）。

在這種情況下，IP-STS服務在概念上只是另一個依賴方（可能相信自己）。

Answer 3

卡空間一直在彈出... client.ClientCredentials.SupportInteractive = false;