5
我正嘗試使用Azure ACS添加新的身份驗證方法以支持ADFS用戶，但我遇到了一個非常特殊的問題。MVC中的Ws聯盟身份驗證在SAML2.0驗證後沒有保留聲明信息
我能夠驗證具有以下配置的SAML2.0：
var audienceRestriction = new AudienceRestriction(AudienceUriMode.Never);
var issuerRegistry = new ConfigurationBasedIssuerNameRegistry();
issuerRegistry.AddTrustedIssuer("XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "https://XXXX.accesscontrol.windows.net/");
app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
{
MetadataAddress = "https://XXXXX.accesscontrol.windows.net/federationmetadata/2007-06/federationmetadata.xml",
Wtrealm = "http://someurl/",
SecurityTokenHandlers = new SecurityTokenHandlerCollection
{
new EncryptedSecurityTokenHandlerEx(new X509CertificateStoreTokenResolver(StoreName.My,StoreLocation.LocalMachine)),
new SamlSecurityTokenHandlerEx
{
CertificateValidator = X509CertificateValidator.None,
Configuration = new SecurityTokenHandlerConfiguration()
{
IssuerNameRegistry = issuerRegistry,
AudienceRestriction = audienceRestriction
}
}
},
});
有了這樣實現的處理程序：
public class SamlSecurityTokenHandlerEx : Saml2SecurityTokenHandler, ISecurityTokenValidator
{
public override bool CanReadToken(string securityToken)
{
return base.CanReadToken(XmlReader.Create(new StringReader(securityToken)));
}
public ClaimsPrincipal ValidateToken(string securityToken, TokenValidationParameters validationParameters,
out SecurityToken validatedToken)
{
validatedToken = ReadToken(new XmlTextReader(new StringReader(securityToken)), Configuration.ServiceTokenResolver);
var claims = new ClaimsPrincipal(ValidateToken(validatedToken));
return claims;
}
public int MaximumTokenSizeInBytes { get; set; }
}
如果我檢查的ValidateToken索賠是通過身份驗證並與我想要的聲明進行身份驗證，但是在它調用回調頁面（我想爲webapp創建新的正確登錄名）之後，它不再擁有關於聯合身份驗證的任何信息。