我有一个WCF服务,需要使用Azure Active Directory进行安全保护。我已经阅读了所有相关的问题,并在social.msdn上进行了研究,但仍无法使我的示例工作。我希望身份验证以以下方式工作。
1.用户从客户端调用WCF服务时不显示任何弹出窗口。 2.用户通过用户名/密码并从Azure ADFS接收身份验证令牌。 3.然后,在应用程序中(现在先假设为控制台应用程序),我们通过CreateChannelWithIssuedToken方法打开通道,并使用从AAD获取的令牌进行所有后续调用。
我正在做什么以及我的问题是什么。 我现在正在使用VS 2012和Identity和Access工具生成适当的配置文件用于WCF服务。因此,我的服务具有以下地址:http://localhost:1785/Service1.svc
然后我登录Azure门户并创建一个名为http://localhost:1785/Service1.svc的新Web应用程序,登录URL http://localhost:1785/Service1.svc和应用程序ID URL http://localhost:1785/Service1.svc。
然后我检查应用程序的端点并复制联合元数据,其格式如下: https://login.windows.net/{some guid}/federationmetadata/2007-06/federationmetadata.xml
使用Identity和Access工具,我向服务项目添加了WAAD身份提供程序,我的web.config文件如下:
当我调用服务时,在Fiddler中看到请求被发送到WS-Fed终点,但响应终点会向我发送带有错误的HTML页面。
AADSTS20012:当我们尝试处理WS-Federation消息时发生错误。该消息无效。
请问您能否建议我在哪里出错了以及如何实现我在问题开头描述的场景?
谢谢。
1.用户从客户端调用WCF服务时不显示任何弹出窗口。 2.用户通过用户名/密码并从Azure ADFS接收身份验证令牌。 3.然后,在应用程序中(现在先假设为控制台应用程序),我们通过CreateChannelWithIssuedToken方法打开通道,并使用从AAD获取的令牌进行所有后续调用。
我正在做什么以及我的问题是什么。 我现在正在使用VS 2012和Identity和Access工具生成适当的配置文件用于WCF服务。因此,我的服务具有以下地址:http://localhost:1785/Service1.svc
然后我登录Azure门户并创建一个名为http://localhost:1785/Service1.svc的新Web应用程序,登录URL http://localhost:1785/Service1.svc和应用程序ID URL http://localhost:1785/Service1.svc。
然后我检查应用程序的端点并复制联合元数据,其格式如下: https://login.windows.net/{some guid}/federationmetadata/2007-06/federationmetadata.xml
使用Identity和Access工具,我向服务项目添加了WAAD身份提供程序,我的web.config文件如下:
<?xml version="1.0"?>
<configuration>
<configSections>
<section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
</configSections>
<appSettings>
<add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
<add key="ida:FederationMetadataLocation" value="https://login.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/federationmetadata/2007-06/federationmetadata.xml" />
<add key="ida:ProviderSelection" value="productionSTS" />
</appSettings>
<location path="FederationMetadata">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior>
<!-- To avoid disclosing metadata information, set the values below to false before deployment -->
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
<!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="false" />
<serviceCredentials useIdentityConfiguration="true">
<!--Certificate added by Identity and Access Tool for Visual Studio.-->
<serviceCertificate findValue="CN=localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<protocolMapping>
<add scheme="http" binding="ws2007FederationHttpBinding" />
<add binding="basicHttpsBinding" scheme="https" />
</protocolMapping>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
<bindings>
<ws2007FederationHttpBinding>
<binding name="">
<security mode="Message">
<message>
<issuerMetadata address="https://login.windows.net/adfs/services/trust/mex" />
</message>
</security>
</binding>
</ws2007FederationHttpBinding>
</bindings>
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true" />
<!--
To browse web app root directory during debugging, set the value below to true.
Set to false before deployment to avoid disclosing web app folder information.
-->
<directoryBrowse enabled="true" />
</system.webServer>
<system.identityModel>
<identityConfiguration>
<audienceUris>
<add value="http://localhost:1785/Service1.svc" />
</audienceUris>
<issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
<authority name="https://sts.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/">
<keys>
<add thumbprint="92B88C3DD981BF1EBCB244FCFA63C007706C79E0" />
<add thumbprint="3270BF5597004DF339A4E62224731B6BD82810A6" />
</keys>
<validIssuers>
<add name="https://sts.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/" />
</validIssuers>
</authority>
</issuerNameRegistry>
<!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
<certificateValidation certificateValidationMode="None" />
</identityConfiguration>
</system.identityModel>
</configuration>
然后我创建了控制台应用程序,并向服务项目添加了服务引用。
添加引用后,配置文件如下所示
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
</startup>
<system.serviceModel>
<bindings>
<ws2007FederationHttpBinding>
<binding name="WS2007FederationHttpBinding_IService1">
<security>
<message>
<!--<issuer address="http://schemas.microsoft.com/2005/12/ServiceModel/Addressing/Anonymous" />-->
<issuer address="https://login.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/wsfed" binding="ws2007HttpBinding"/>
<issuerMetadata address="https://login.windows.net/adfs/services/trust/mex" />
<tokenRequestParameters>
<trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
<trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType>
<trust:KeySize xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">256</trust:KeySize>
<trust:KeyWrapAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</trust:KeyWrapAlgorithm>
<trust:EncryptWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptWith>
<trust:SignWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2000/09/xmldsig#hmac-sha1</trust:SignWith>
<trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/10/xml-exc-c14n#</trust:CanonicalizationAlgorithm>
<trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
</trust:SecondaryParameters>
</tokenRequestParameters>
</message>
</security>
</binding>
</ws2007FederationHttpBinding>
<ws2007HttpBinding>
<binding name="">
<security mode="TransportWithMessageCredential">
<transport clientCredentialType="InheritedFromHost" />
<message establishSecurityContext="false" />
</security>
</binding>
</ws2007HttpBinding>
</bindings>
<client>
<endpoint address="http://localhost:1785/Service1.svc" binding="ws2007FederationHttpBinding"
bindingConfiguration="WS2007FederationHttpBinding_IService1"
contract="SomeService.IService1" name="WS2007FederationHttpBinding_IService1">
<identity>
<certificate encodedValue="AwAAAAEAAAAUAAAACLf4gntwdBYHCTmyInF5gU9oXNYgAAAAAQAAANUBAAAwggHRMIIBOqADAgECAhAT1EWwzeLBk0ez5Bg+JKyVMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xMjExMTUxNTMyMDdaFw0xNzExMTUwMDAwMDBaMBQxEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtgkwd4GLTIwRtoHFjoSCBqrEcFgYMPh7f8aSWSYTrBGtaS9c2zOAuhxnaIAo1ELe3JLWUJmHq35IEu34gTwN9RfSna9Gis45TKrINY5nlAmKu0XpuI3ncf4WQRPbPx7hS6A0BHytXqQ3+FA1BSRr13iNUaaAkqwcCLWHXqno188CAwEAAaMkMCIwCwYDVR0PBAQDAgSwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBBQUAA4GBACKXEQpUUVm1g3BfpqRSn9hIYpuLojPX2wfySbIAan4jK5oo0dC5QUkbRjyEtqe6Io+POL3gbtoVzJOXnUDvYDUXRaR6dUmHJ5A4JLChUJZLHis0resLKO5yXrf4JqJSwEsL4Et5xiIRPoEvdPWWBhkDwuMvDGtQrzpp6ZYEt2sh" />
</identity>
</endpoint>
</client>
</system.serviceModel>
</configuration>
我试图启动控制台应用程序,但是出现了必须指定有效问题的错误。
我认为,在Azure AD配置页面的终结点中可以找到有效的问题,并将WS-Federation单一登录终结点复制为发布者。
以下是控制台程序代码。
var client = new SomeService.Service1Client();
client.ClientCredentials.UserName.UserName = "<valid user name>";
client.ClientCredentials.UserName.Password = "<password>";
client.GetData(10);
当我调用服务时,在Fiddler中看到请求被发送到WS-Fed终点,但响应终点会向我发送带有错误的HTML页面。
AADSTS20012:当我们尝试处理WS-Federation消息时发生错误。该消息无效。
请问您能否建议我在哪里出错了以及如何实现我在问题开头描述的场景?
谢谢。