正如我在 another question 中所描述的那样我构建了一个 Web 服务,该服务将使用用户名/密码并基于这些凭据在 ADFS2 中对用户(移动应用程序)进行身份验证。我的 Web 服务在 ADFS 上配置为 RP。 ADFS 颁发 SAML 2.0 token 。
这是网络方法的代码:
public class MobileAuthService : IMobileAuthService
{
private const string adfsBaseAddress = @"https://<my_adfs_hostname>/adfs/services/";
private const string endpointSuffix = @"trust/13/issuedtokenmixedsymmetricbasic256";
public string AuthenticateUser(string username, string password)
{
var binding = new WS2007HttpBinding(SecurityMode.Message);
binding.Security.Message.EstablishSecurityContext = false;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
binding.Security.Mode = SecurityMode.TransportWithMessageCredential;
var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(adfsBaseAddress + endpointSuffix))
{
TrustVersion = TrustVersion.WSTrust13
};
trustChannelFactory.Credentials.UserName.UserName = username;
trustChannelFactory.Credentials.UserName.Password = password;
var tokenClient = (WSTrustChannel)trustChannelFactory.CreateChannel();
var rst = new RequestSecurityToken(RequestTypes.Issue, KeyTypes.Symmetric);
var token = tokenClient.Issue(rst);
// do some token-related stuff
return token.Id;
}
}
当我尝试运行它时(来自浏览器的 GET 调用,因为它为此端点配置了 Web http 绑定(bind))我得到以下异常:
System.ServiceModel.Security.MessageSecurityException - "An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail."
有内部异常:
System.ServiceModel.FaultException - "An error occurred when verifying security for the message."
我猜这与响应签名或证书有关,但我不知道如何克服这个问题,因为我是 WIF 的新手。
最佳答案
我已经设法(部分)解决了这个问题。我在我的代码中做了一些改动,但问题似乎与以下内容有关:
- STS 端点 - 应该是
/trust/13/usernamemixed
用于这种类型的身份验证 - RST key 类型 - 当我设置它时
Bearer
它开始返回 SAML token
这是我的最新版本:
public class MobileAuthService : IMobileAuthService
{
private const string stsEndpointAddress = @"https://<my_adfs_hostname>/adfs/services/trust/13/usernamemixed";
private const string relyingPartyAddress =
"https://<my_service_addr>/Auth.svc";
public string AuthenticateUser(string username, string password)
{
var binding = new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential)
{
ClientCredentialType = HttpClientCredentialType.None
};
var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(stsEndpointAddress))
{
TrustVersion = TrustVersion.WSTrust13
};
var channelCredentials = trustChannelFactory.Credentials;
channelCredentials.UserName.UserName = username;
channelCredentials.UserName.Password = password;
channelCredentials.SupportInteractive = false;
var tokenClient = (WSTrustChannel)trustChannelFactory.CreateChannel();
var rst = new RequestSecurityToken(RequestTypes.Issue, KeyTypes.Bearer)
{
AppliesTo = new EndpointReference(relyingPartyAddress),
ReplyTo = relyingPartyAddress,
TokenType = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
};
// to some token-related stuff (like transformations etc...)
}
}
我希望这对遇到类似问题的人有所帮助。
关于c# - 向 ADFS 进行身份验证时出现 "An error occurred when verifying security for the message"异常,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/19296959/