STS的RequestSecurityToken并将其发布到我的网站

我的网站实现了基于AD FS的身份验证。现在我需要通过客户端以编程方式访问我的网站。我的客户端应该使用当前登录的用户上下文从ADFS服务器请求安全令牌。我已成功地使用客户端的用户名和密码从adfs/services/trust/13/usernamemixed端点请求安全令牌，并将其发布到我的网站。STS的RequestSecurityToken并将其发布到我的网站

什么不是我的工作是从adfs/services/trust/13/windowsmixed端点使用DefaultNetworkCredentials请求相同的标记。我收到错误The HTTP request was forbidden with client authentication scheme 'Anonymous'.。我正在使用Microsoft.IdentityModel SDK（而不是.NET 4.5中的System.IdentityModel）。

这是我的代码片段。

factory = new MSWSTrustChannelFactory(
    new Microsoft.IdentityModel.Protocols.WSTrust.Bindings.WindowsWSTrustBinding(SecurityMode.TransportWithMessageCredential), 
        stsUrl); 

    factory.TrustVersion = TrustVersion.WSTrust13; 

    factory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials; 

    var rst = new RequestSecurityToken 
    { 
     RequestType = RequestTypes.Issue, 
     AppliesTo = new EndpointAddress(realm), 
     KeyType = KeyTypes.Bearer, 
     RequestDisplayToken = true 
    }; 

    MSIWSTrustChannelContract channel = factory.CreateChannel(); 
    RequestSecurityTokenResponse rstr; 
    SecurityToken token = channel.Issue(rst, out rstr);

我对ADFS服务器没有任何控制权，无法从那里调试出错的地方。无论我能做什么，只是从客户端。任何想法上面的代码出了什么问题？任何帮助或指针，不胜感激。

来源

2013-03-09 Charles Prakash Dasari

我认为你需要将消息安全的EstablishSecurityContext设置为FALSE
binding.Security.Message.EstablishSecurityContext = false;

以下代码适用于我。

  WS2007HttpBinding binding = new WS2007HttpBinding(SecurityMode.TransportWithMessageCredential); 
      binding.Security.Message.EstablishSecurityContext = false;    
      binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None; 
      if (isWindowsUser) 
      { 
       binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows; 
       ep = new EndpointAddress("https://abc.com/adfs/services/trust/13/windowsmixed");      
      } 
      else 
      { 
       binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName; 
       ep = new EndpointAddress("https://abc.com/adfs/services/trust/13/usernamemixed");      
      } 
      factory = new WSTrustChannelFactory(binding, ep); 
      factory.TrustVersion = TrustVersion.WSTrust13; 

       factory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;      


      var rst = new RequestSecurityToken 
      { 
       RequestType = RequestTypes.Issue, 
       AppliesTo = new EndpointReference("urn:adfsmonitor"), 
       KeyType = KeyTypes.Bearer, 
      }; 
      IWSTrustChannelContract channel = factory.CreateChannel(); 
      GenericXmlSecurityToken genericToken = channel.Issue(rst) 
      as GenericXmlSecurityToken; 
      return genericToken.TokenXml.InnerXml.ToString();

来源

2014-09-18 06:28:05

STS的RequestSecurityToken并将其发布到我的网站

回答

相关问题