STS的RequestSecurityToken並將其發佈到我的網站

我的網站實現了基於AD FS的身份驗證。現在我需要通過客戶端以編程方式訪問我的網站。我的客戶端應該使用當前登錄的用戶上下文從ADFS服務器請求安全令牌。我已成功地使用客戶端的用戶名和密碼從adfs/services/trust/13/usernamemixed端點請求安全令牌，並將其發佈到我的網站。STS的RequestSecurityToken並將其發佈到我的網站

什麼不是我的工作是從adfs/services/trust/13/windowsmixed端點使用DefaultNetworkCredentials請求相同的標記。我收到錯誤The HTTP request was forbidden with client authentication scheme 'Anonymous'.。我正在使用Microsoft.IdentityModel SDK（而不是.NET 4.5中的System.IdentityModel）。

這是我的代碼片段。

factory = new MSWSTrustChannelFactory(
    new Microsoft.IdentityModel.Protocols.WSTrust.Bindings.WindowsWSTrustBinding(SecurityMode.TransportWithMessageCredential), 
        stsUrl); 

    factory.TrustVersion = TrustVersion.WSTrust13; 

    factory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials; 

    var rst = new RequestSecurityToken 
    { 
     RequestType = RequestTypes.Issue, 
     AppliesTo = new EndpointAddress(realm), 
     KeyType = KeyTypes.Bearer, 
     RequestDisplayToken = true 
    }; 

    MSIWSTrustChannelContract channel = factory.CreateChannel(); 
    RequestSecurityTokenResponse rstr; 
    SecurityToken token = channel.Issue(rst, out rstr);

我對ADFS服務器沒有任何控制權，無法從那裏調試出錯的地方。無論我能做什麼，只是從客戶端。任何想法上面的代碼出了什麼問題？任何幫助或指針，不勝感激。

來源

2013-03-09 Charles Prakash Dasari

我認爲你需要將消息安全的EstablishSecurityContext設置爲FALSE
binding.Security.Message.EstablishSecurityContext = false;

以下代碼適用於我。

  WS2007HttpBinding binding = new WS2007HttpBinding(SecurityMode.TransportWithMessageCredential); 
      binding.Security.Message.EstablishSecurityContext = false;    
      binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None; 
      if (isWindowsUser) 
      { 
       binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows; 
       ep = new EndpointAddress("https://abc.com/adfs/services/trust/13/windowsmixed");      
      } 
      else 
      { 
       binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName; 
       ep = new EndpointAddress("https://abc.com/adfs/services/trust/13/usernamemixed");      
      } 
      factory = new WSTrustChannelFactory(binding, ep); 
      factory.TrustVersion = TrustVersion.WSTrust13; 

       factory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;      


      var rst = new RequestSecurityToken 
      { 
       RequestType = RequestTypes.Issue, 
       AppliesTo = new EndpointReference("urn:adfsmonitor"), 
       KeyType = KeyTypes.Bearer, 
      }; 
      IWSTrustChannelContract channel = factory.CreateChannel(); 
      GenericXmlSecurityToken genericToken = channel.Issue(rst) 
      as GenericXmlSecurityToken; 
      return genericToken.TokenXml.InnerXml.ToString();

來源

2014-09-18 06:28:05

STS的RequestSecurityToken並將其發佈到我的網站

回答

相關問題