wcf - 为什么在传入联合安全 token 时此 WCF 调用失败

Question

我正在尝试将安全 token 从客户端应用程序传递到 WCF 服务以进行身份​​验证。

对于此示例，我只使用标准文件、新 WCF 应用程序项目并尝试调用 GetData 方法。

我在客户端得到以下异常

{"The message could not be processed. This is most likely because the action 'http://tempuri.org/IService1/GetData' is incorrect or because the message contains an invalid or expired security context token or because there is a mismatch between bindings. The security context token would be invalid if the service aborted the channel due to inactivity. To prevent the service from aborting idle sessions prematurely increase the Receive timeout on the service endpoint's binding."}

如果我在 WCF 服务上启用跟踪，我会看到以下错误

There was no channel that could accept the message with action 'http://tempuri.org/IService1/GetData'.

我的服务的 Web.Config 如下所示

<?xml version="1.0"?>
<configuration>
  <configSections>
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />        
  </configSections>

  <system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5"/>
  </system.web>

  <!--Configure STS-->
  <system.identityModel>
    <identityConfiguration>
      <audienceUris>
        <add value="https://stsserver.security.int/myApp" />
      </audienceUris>
      <issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089">
        <trustedIssuers>
          <add thumbprint="‎3c8fc34bd483b07ba0d1509827fc4788c36247e4" name="StartSSL Login" />
        </trustedIssuers>
      </issuerNameRegistry>
      <certificateValidation certificateValidationMode="None"/>
    </identityConfiguration>
  </system.identityModel>

  <system.serviceModel>
    <bindings>
      <ws2007FederationHttpBinding>
        <binding name ="IdentityServer">
          <security mode="TransportWithMessageCredential">
          </security>
        </binding>
      </ws2007FederationHttpBinding>
    </bindings>

    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
    <services>
      <service name="Services.Service1" behaviorConfiguration="CertificateBehavior">
        <endpoint name="ws" binding="ws2007FederationHttpBinding" bindingConfiguration="IdentityServer" contract="Services.IService1" address=""/>
      </service>
    </services>

    <behaviors>
      <serviceBehaviors>
        <behavior name="CertificateBehavior">
          <serviceCredentials>
            <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>

  </system.serviceModel>    
</configuration>

调用此 WCF 服务的客户端应用程序中的方法如下所示

static void CallSecuredService(SecurityToken samlToken)
{
    var binding = new WS2007FederationHttpBinding((WSFederationHttpSecurityMode.TransportWithMessageCredential));
    binding.Security.Message.IssuedKeyType = SecurityKeyType.BearerKey;
    binding.Security.Message.EstablishSecurityContext = false;

    var factory = new ChannelFactory<IService1>(binding, new EndpointAddress("https://localhost/myservice/Service1.svc"));
    factory.Credentials.SupportInteractive = false;
    factory.Credentials.UseIdentityConfiguration = true;
    var proxy = factory.CreateChannelWithIssuedToken(samlToken);

    Console.WriteLine(proxy.GetData(1));
}

任何关于我应该检查的事情的指示都会很棒，因为我现在对这个有点不知所措。我不确定如何进一步调试它？

Answer 1

我终于设法克服了这个错误。问题是服务和客户端绑定(bind)之间的一个小失配。

将我在 web.config 中的绑定(bind)更改为此可以解决问题

<bindings>
  <ws2007FederationHttpBinding>
    <binding name ="IdentityServer">
      <security mode="TransportWithMessageCredential">
        <message issuedKeyType="BearerKey" establishSecurityContext="false"/>
      </security>
    </binding>
  </ws2007FederationHttpBinding>
</bindings>