AD FS 2.0 与 PingIdentity / AppFabric Labs ACS
可能是一个简单的问题，我只是在寻找已经实现此功能的人。我的 AppFabric Labs v2 目前正在使用带有 Active Directory 的 AD FS 2.0 服务器，一切都很好，然后链接到 AppFabric，并路由到我的 .NET 应用程序（依赖方）。
我的问题很简单 - 如何让 PingIdentity 与 AppFabric 配合使用并成为 STS 提供商？我尝试从 PingIdentity 管理系统导入 .XML 元数据，但没有任何进展。
人们将其 AD FS 2.0 服务器附加到 AppFabric，然后将 PingIdentity 作为声明提供者附加到其 AD FS 2.0 服务器，这是常见的途径吗？
Could be a simple question, I'm just looking really for someone that has implemented this. I've got AppFabric Labs v2 currently working with an AD FS 2.0 server with Active Directory, that's all fine and then this links to AppFabric, and routes round to my .NET app (relying party).
My question is simple - how do I get PingIdentity to work with AppFabric and come up as an STS provider? I've tried importing the .XML meta data from the PingIdentity admin system with no joy.
Is the common route for people to attach their AD FS 2.0 server to AppFabric and then attach PingIdentity to their AD FS 2.0 server as a claims provider?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
将元数据导入 ACS 后发生了什么？您能否提供更多有关不起作用的详细信息？
关于：
无论哪种方式都可以。 ACS仍然是“实验室”，所以没有多少生产系统上线，所以就实际案例而言，你会发现更多的ADFS<->Ping。但是，同样，这两种方法都可以，而这是“视情况而定”的方法之一。我假设您的 PingIdentity STS 是一个“身份提供商”（意味着它对用户进行身份验证），因此一般来说它将是链中的最后一个 STS。
在做出决定时，您需要问自己一些问题：
另外，您标记了这个问题 作为“已回答”，但似乎与此相关。
What happened when you imported the metadata into ACS? Can you provide more details of what's not working?
Regarding:
Either way could work. ACS is still "labs" so not many production systems have gone live, so in terms of actual cases, you will find more ADFS<->Ping. But, again, either would work and this is one of those "it depends". I'm assuming your PingIdentity STS is an "Identity Provider" (meaning that it authenticates users), so in general it would be the last STS in the chain.
Some questions you need to ask yourself for making a decision:
Also, you marked this question as "answered" but it seems related to this one.
PingFed 支持用于被动请求者配置文件（以及 SAML 1.0/1.1 和 2.0）OOTB 的 WS-Federation，以及用于主动配置文件用例的 SAML 1.1 和 2.0（作为主动和被动的 IDP 和 SP）。我相信 ACS 不支持 PRP 的 SAML 2.0，但它支持 WS-Federation。我认为 ACS 仅支持主动请求者配置文件的 SAML 2.0 令牌。
在 ACS 中更换 IDP 端点应该不难，但我从未研究过这是如何完成的。
HTH——伊恩
PingFed supports WS-Federation for Passive Requester Profile (as well as SAML 1.0/1.1 and 2.0) OOTB as well as SAML 1.1 and 2.0 for Active Profile use cases (both as IDP and SP for Active and Passive). I believe ACS does not support SAML 2.0 for PRP but it does support WS-Federation. I think ACS does support SAML 2.0 tokens for Active Requester Profile only.
It shouldn't be that hard to swap out an IDP Endpoint in ACS but I've never looked at how that is accomplished.
HTH -- Ian