c# - 如何根据 Active Directory 联合身份验证服务 (ADFS) 验证用户名和密码？

Question

我想向 .Net 控制台应用程序或网页提供用户名和密码，以针对 Active Directory 联合身份验证服务进行身份验证。 此时我只有https://mycompany.com/FederationMetadata/2007-06/FederationMetadata.xml ，我有有效的用户名和密码来测试。

我关注了一些文章，即 https://dotnetcodr.com/2013/02/28/claims-based-authentication-in-mvc4-with-net4-5-c-part-2-storing-authentication-data-in-an-authentication-session/

我查看后发现，我们必须在 ADFS 中添加“依赖方”，才能将 ADFS 用作身份验证存储。

在 2nd Link 中，它使用 Federated IdP。相反，我想使用一些控制台应用程序来提供用户名和密码并进行身份验证。 但我不清楚在控制台应用程序中在哪里提供用户名和密码。 任何帮助表示赞赏!提前致谢。

Answer 1

下面的代码适合我

using System.IdentityModel.Tokens;
using Microsoft.IdentityModel.Protocols.WSTrust;
using System.ServiceModel;
using System.ServiceModel.Security;
using WSTrustChannel = Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel;
using WSTrustChannelFactory = Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannelFactory;


namespace SOS.Tools.AdfsConnectionChecker

{
    internal class Token

    {

        public static SecurityToken GetToken(string username, string password, string tokenIssuer, string appliesTo, out RequestSecurityTokenResponse rsts)

        {
            WS2007HttpBinding binding = new WS2007HttpBinding();
            binding.Security.Message.EstablishSecurityContext = false;
            binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
            binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
            binding.Security.Mode = SecurityMode.TransportWithMessageCredential;


            var tokenIssuerUrlFormat = "https://{0}/adfs/services/trust/13/usernamemixed";
            var tokenIssuerUrl = string.Format(tokenIssuerUrlFormat, tokenIssuer);


            WSTrustChannelFactory trustChannelFactory =
                new WSTrustChannelFactory(binding, new EndpointAddress(tokenIssuerUrl));

            trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;
            trustChannelFactory.Credentials.UserName.UserName = username;
            trustChannelFactory.Credentials.UserName.Password = password;

            trustChannelFactory.ConfigureChannelFactory();



            // Create issuance issuance and get security token 
            RequestSecurityToken requestToken = new RequestSecurityToken(WSTrust13Constants.RequestTypes.Issue);
            requestToken.AppliesTo = new EndpointAddress(appliesTo);

            WSTrustChannel tokenClient = (WSTrustChannel) trustChannelFactory.CreateChannel();
            SecurityToken token = tokenClient.Issue(requestToken, out rsts);
            return token;

        }

}

• 用户名 - 域用户名(例如 Name.FamalyName@DomainName.local)
• 密码 - 域用户密码
• tokenIssuer - ADFS URL (adfs.somedomain.com)。该 ADFS 应连接到创建用户名
的 Active Directory
• appliesTo - 您想要 token 的应用程序(例如 https://apps.anydomain.com/WcfService1 )。它必须在 tokenIssuer 上配置为依赖方。