使用 ADFS 重新进行身份验证？
我的任务是编写一个使用 ADFS 进行身份验证的 ASP.NET Web 应用程序。但是，在应用程序的某个阶段，用户必须重新进行身份验证并再次提供其用户名和密码。
这可以通过 ADFS 来完成吗？
I am being tasked with writing an asp.net web app that will use ADFS for authentication. However, at one stage in the application users will have to re-authenticate and supply their username and password again.
Can this be done with ADFS?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
ASP.NET 应用程序可以是 STS 的主动客户端，也可以是被动客户端。当您需要采取行动时，提供一些输入字段并要求用户提供额外的身份证明。使用 WSTrustChannelFactory 将此信息（可能还有原始令牌）传递给STS 获取更新的新代币，并且包含足以授权更高价值交易的声明。
The ASP.NET app can be an active client to the STS as well as a passive one. When you need to step up, provide some input fields and ask the user for additional proof of who they are. Using the WSTrustChannelFactory, pass this info (and possibly the original token) to the STS to get a new token that is fresher and contains claims that are sufficient to authorize the the higher value transaction.
重认证的目的是什么，即用户需要证明什么？
我假设应用程序需要具有最近身份验证时间戳（例如，最后 10 秒内）的登录令牌，以便应用程序可以合理地确定客户端系统确实仍在同一用户的控制之下。
（顺便说一句，请注意您的 Web 服务器和 AD FS 服务器之间的时钟差异。）
在接下来的几个月中，我将调查类似的场景，我当前的想法是使用 SessionAuthenticationModule.SessionSecurityTokenReceived 事件，如 Vittorio Bertocci 的这篇博文< /a>.但是，这并不是完整的解决方案，因为这仅强制 AD FS 给出令牌，但不会强制 AD FS 给出具有最近身份验证时间戳的令牌。
所以还没有答案，但也许这些提示有帮助。
What is the goal of the re-authentication, i.e., what does the user need to prove?
I'm presuming the application wants a sign-in token with a recent authentication timestamp (within, say, the last 10 seconds), so that the application is reasonably sure that the client system is really still under that same user's control.
(Watch out for clock differences between your web server and your AD FS server, by the way.)
In the coming months I will be investigating a similar scenario, and my current idea is to use the SessionAuthenticationModule.SessionSecurityTokenReceived Event, as described in this blog post by Vittorio Bertocci. However, that cannot be the entire solution, since this only forces AD FS to give out a token, but it does not force AD FS to give out a token with a recent authentication timestamp.
So no answer yet, but perhaps these hints help.
这篇文章介绍了一个“升级”过程，可能会帮助您这个场景。不过我没用过，所以无法详细评论。它看起来非常接近您想要做的事情。
This article describes a "step-up" procedure that might help you in this scenario. I haven't used it though, so I can't comment in detail. It looks very close to what you are trying to do.
减少 TokenLifetime 属性使您可以重新验证用户身份。假设 TokenLifetime 默认为 60 分钟，但它在 20 分钟之前显示弹出窗口。但可能会出现数据丢失的情况
Reducing TokenLifetime property makes you to re-authenticate users. suppose by TokenLifetime is by default is 60 min but it shows popup before 20 mins. but there may be data loss
对于使用 WIF 的 ASP.NET，您使用 WS-Federation 作为与 ADFS 交互并获取令牌的协议。在此范围内，您可以在 ADFS 的登录请求中指定 wrefresh=0。发送此消息后，ADFS 会忽略任何先前的 cookie 状态（Web SSO）并执行新的身份验证，因此将向应用程序颁发新令牌。如果是内网域加入机器的情况下，这将是无声的。
要进行用户交互，您可以执行以下两件事之一：
谢谢
//萨姆（@MrADFS）
For ASP.NET using WIF, you are using WS-Federation as the protocol to interact with ADFS and get a token. Within this, you can specify wrefresh=0 in the sign-in request to ADFS. When this is sent, ADFS ignores any prior cookie state (web SSO) and does a fresh authentication and so a new token will be issued to the app. In the case of intranet domain joined machine case, this will be silent.
To have user interaction, you can do one of 2 things
Thanks
//Sam (@MrADFS)