使用 WIF 创建自定义 STS-IP 以及为什么不这样做
我需要为我们的 Web 应用程序和服务实现 STS-IP 服务器。服务器将需要为以下场景颁发 SAML 令牌：
- 业务合作伙伴提交其 SAML 令牌，该令牌将转换为带有我们应用程序所需声明的 SAML 令牌。该令牌用于访问我们的网络应用程序和服务。
- 我们面向公众的应用程序需要用户登录（通过表单身份验证），然后使用 SAML 令牌访问我们的 Web 应用程序和服务。
- 我们的客户端（没有 STS 信任）需要通过我们的 STS-IP 服务器进行身份验证，获取 SAML 令牌，并使用该令牌访问我们的 WCF 服务。
在所有 3 个场景中，我们需要对应用程序和服务使用的 SAML 令牌进行自定义声明。我们的想法是，一旦我们识别了用户，我们就会在后端系统中查找他们的授权并附加声明。
在这些场景中，您可以假设后端身份验证存储是自定义实现，身份验证存储在 Active Directory 中，授权存储在数据库中。
所以我的想法是，我们需要使用 Windows Identity Framework 之类的东西创建一个自定义 STS-IP 服务器。但我也读到您不应该这样做，因为这可能需要一些时间。
我可以使用现成的 STS-IP 服务器吗？我所看到的一切都是一个系统到另一个系统（SAML 到 SAML 或 AD 到 SAML）之间的映射。
为什么构建生产就绪的 STS-IP 会“花费很长时间”？我很容易地使用 WIF 构建了一个，但我想我不了解这样做的风险。
I have a need to implement a STS-IP server for our web applications and services. The server will need to issue SAML tokens for the following scenarios:
- Business partner submits their SAML token which is converted to a SAML token with the claims required for our applications. This token is used to access our Web Applications and Services.
- Our public facing applications need to have a user sign in (via forms authentication) and then access our web applications and services with a SAML token.
- Our clients (without a STS trust) needs to authenticate with our STS-IP server, get a SAML token, and use that token to access our WCF services.
In all 3 scenarios, we need to have custom claims on the SAML token that our applications and services use. The thought is once we identify the user, we would look up their authorization in our back-end systems and attach claims.
In these scenarios, you can assume the back-end authentication store is a custom implementation with authentication stored in Active Directory and authorization stored in a database.
So my thought has been, we need to create a custom STS-IP server using something like Windows Identity Framework. But I have also been reading that you should not do this because it can take some time.
Can I use an off-the-shelf STS-IP server? Everything I've seen is a mapping between one system to another (SAML to SAML or AD to SAML).
Why will it "take a long time" to build a production ready STS-IP ? I built one using WIF very easily, but I guess I don't understand the risks in doing this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
就“这需要很长时间”而言，显示如何执行此操作的文档非常差。请参阅此处：http： //social.msdn.microsoft.com/Forums/en-US/Geneva/thread/257d93be-165e-45a6-a277-fc7ed2286e7d/
无论如何，您只需要查看 Microsoft 提供的代码示例即可：Google 身份开发人员培训套件。这应该可以帮助您入门。
In terms of "It will take a long time", the documentation showing how to do this is very poor. See here: http://social.msdn.microsoft.com/Forums/en-US/Geneva/thread/257d93be-165e-45a6-a277-fc7ed2286e7d/
Anyhow, you'll simply need to look over the code samples that Microsoft provides: Google for Identity Developer Training Kit. That should help you get started.
您为什么不考虑使用 ADFS？如果用于身份验证的后备存储是 AD，那么 ADFS 可能是一个很好的评估候选者。
Why are you not considering using ADFS? If the backing store for authentication is AD, then ADFS is probably a good candidate to evaluate.
在编写自己的 STS 之前，您可能需要查看此博客并仔细查看 STS 中可能需要的功能。仅仅因为您可以自己构建一个并不总是意味着您应该这样做。
将 adfs 扩展到多个身份和属性存储
Before writing you own STS, you may want to check out this blog and closely review the features that you may need in the STS. Just because you can build one yourself, doesn't always mean you should.
extending adfs to multiple identity and attribute stores
他们的“为什么不”相对简单：当您可以在一天之内放入现成的 STS 来涵盖您公司可能遇到的各种情况时，为什么要花费数周时间来构建可能只能处理单个用例的东西跟上了吗？自己构建它还需要您成为 SAML 专家（这可能不是您公司时代最好的我们）。
查看 -
http://www.pingidentity.com/our-solutions/pingfederate.cfm
祝你好运——伊恩
They "why not" is relatively simple: Why take weeks to build something that will probably only handle a single use-case when you can put in off-the-shelf STS in a day that will cover all sorts of things your company may come up with? Building it yourself will also require you to become an expert in SAML (which is probably not the best us of your company's time).
Check out --
http://www.pingidentity.com/our-solutions/pingfederate.cfm
Good luck -- Ian
同意@eugenio - 为什么不使用 ADFS？
正如所讨论的，ADFS 只能针对 AD 进行身份验证，但它可以从 AD/LDAP/SQL 服务器派生授权属性
STS 的具体细节在 VS 2010 以及身份工具包中提供。一个简单的 STS 可以快速原型化。
有一些可用的例子。已经提到了 StarterSTS 以及 SelfSTS。
困难的部分是确保安全，特别是如果这将是生产系统的一部分。根据“史蒂夫谈安全”构建您自己的目录联合服务：
这就是互联网上的所有示例都以粗体显示免责声明的原因：
请勿在生产环境中使用
Agree with @eugenio - why not use ADFS?
ADFS can only authenticate against AD as discussed but it can derive authorisation attributes from AD / LDAP / SQL server
The nuts and bolts for an STS are available in VS 2010 plus the identity tool kits. A simple STS can be quickly prototyped.
There are some examples available. StarterSTS is already mentioned plus SelfSTS.
The hard part is getting the security right especially if this will be part of a production system. As per "Steve on Security" Build your own Directory Federation Service:
That's the reason that all the samples on the Internet have disclaimers in bold:
Do not use in a Production environment