WCF STS 负载平衡和证书
想知道在使用签名和加密令牌的负载平衡环境中部署自定义 WCF - 安全令牌服务 (STS) 的最佳实践是什么？
我们使用 Cirtix NetScaler 来处理负载平衡和 SSL 终止（即证书仅安装在 NetScaler 服务器上）。已指定 STS 通过 SigningCertificateName 和 EncryptionCertificateName 应用程序设置对令牌进行签名和加密。但是，当前的 Web 服务器配置没有在其证书存储中安装本地证书。
所以我的问题是：-
- 如果通过 SSL 传输令牌，我们是否需要担心令牌的签名和加密？
- 我们应该在每个 Web 服务器上安装证书还是可以使用负载均衡器？
- 我们可以在每个 Web 服务器上使用相同的证书吗？还是需要为每个 Web 服务器购买一个证书？
Was wondering what the best practice for deploying a custom WCF - Security Token Service (STS) in a load balancing environment that uses signs and encrypts the token?
We're using Cirtix NetScaler to handle the load balancing and SSL termination (i.e. certificate is only installed on the NetScaler server). The STS has been specified to sign and encrypt the token via the SigningCertificateName and EncryptionCertificateName app settings. However the current web server configuration does not have a local certificate installed within it's certification store.
So my questions are:-
- Do we need to worry about signing and encrypting the token if it's transferred over SSL?
- Should we install the certificate on every web server or can we use the load balancer?
- Can we use the same certificate on each web server or do we need to buy a certificate for each web server?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不签署其令牌的 STS 没有多大用处：没有签名，任何依赖方都无法区分 STS 颁发的有效令牌和恶意者欺骗的令牌。
您安装的支持 SSL 的证书通常与 STS 的签名证书不同。后者标识的是服务，而不是 Web 服务器。因此，请务必继续在负载均衡器上安装 SSL 证书。但是您将需要另一个证书，代表服务的身份，安装在托管服务的每台计算机上（及其私钥），用作签名证书。每个服务器上的证书应该相同（它是相同的服务）。
但是，您通常不需要购买这样的证书：您可以颁发自己的证书 - 您只需确保每个潜在的依赖方都配置为将证书识别为受信任的 STS，并且还信任证书的根颁发者（如果是自签名证书，则为证书本身；如果使用证书服务器颁发证书，则为根证书）。
An STS which does not sign its tokens is not much use: without a signature, no relying party will be able to distinguish between a valid token issued by the STS and a token spoofed by someone with evil intent.
The certificate you install to support SSL is generally different to the STS's signing certificate. The latter identifies the Service, not the web server. So, by all means carry on installing the SSL certificate just on the load balancer. But you will need another certificate, representing the identity of the Service, installed (with its private key) on each machine which hosts the service, for use as the SigningCertificate. It should be the same certificate on each server (it's the same Service).
However, you typically don't need to buy such a certificate: you can issue your own - you just need to make sure each potential Relying Party is configured to recognise the certificate as a trusted STS, and also trusts the root issuer of the certificate (which will be either the certificate itself, if it is a self-signed certificate, or your root certificate, if you used a certificate server to issue it).