帮助进行 WIF 概念验证
我负责在我的组织中实施 Windows Identity Foundation 的概念验证。之所以采用POC，是因为我们没有实现ADFS，但希望随着我们的发展，为应用程序制定统一的身份验证和授权策略。
我将使用的解决方案包含一个 ASP.NET MVC 2 应用程序，该应用程序使用带有后端 SQL Server 数据库的 RESTful WCF 服务应用程序。该解决方案当前使用 Windows 身份验证，并根据经过身份验证的用户的组成员身份分配自定义权限。我们希望在新解决方案中保留单点登录功能。
以下是我需要帮助的内容：
- 设置临时 IP STS 以代替 ADFS
- 设置中继 STS，将应用程序特定的声明添加到令牌
- 如何设置允许单点登录的解决方案，这意味着我访问 MVC 站点时不提示输入用户凭据，而是使用他们的 (Windows) 身份。
- 我还想确保网络服务在其他消费者尝试访问它们时是安全的。
任何将其放在一起的帮助将不胜感激。我正在阅读的大部分内容都假设 ADFS 已就位并使用表单身份验证，因此我不知道如何满足我的要求。
I have been charged with the task of implementing a proof-of-concept for Windows Identity Foundation in my organization. The reason for the POC is that we do not have ADFS implemented but want to develop a unified authentication and authorization strategy for applications as we move forward.
The solution I will be working with consists of an ASP.NET MVC 2 application that consumes a RESTful WCF service application with a back-end SQL Server database. The solution currently uses Windows Authentication with custom permissions assigned based on the authenticated user's group membership. We want to maintain the single sign-on capabilities in the new solution.
Here's what I need help with:
- Setting up a temporary IP STS to use in lieu of ADFS
- Setting up a relaying STS that adds application-specific claims to the token
- How to set-up the solution the allow single sign-on, meaning that I don't prompt for the user's credentials but use their (Windows) identity when accessing the MVC site.
- I also want to make sure that the web services are secure in the event another consumer tries to access them.
Any help putting this together would be greatly appreciated. Most of what I'm reading assumes ADFS is in place and uses Forms Authentication so I'm at a loss how to satisfy my requirements.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
查看 IdentityServer。这是基于 MVC 的（带有示例 MVC 客户端），允许针对基于 SQL Server 角色的数据库进行身份验证。这用作您的 STS，您可以添加代码来添加特定声明。它唯一不会解决的是第 3 点，因为它使用数据库身份验证。
它最近已升级为支持 Azure 集成。然后，您可以使用 Facebook、Google 等进行身份验证。可能不感兴趣，但肯定会带来一个精彩的演示。！
顺便说一句，请查看 SelfSTS。这是一个 STS，可让您轻松配置所需的任何类型的声明（尽管无需身份验证）。对于简单的索赔 PoC 非常有用。
Have a look at IdentityServer. This is a MVC based (with a sample MVC client) which allows authentication against a SQL Server roles based DB. This serves as your STS and you can add code to add specific claims. The only thing it won't address is point 3 as it uses DB authentication.
It has recently been upgraded to support Azure integration. That then allows you to authenticate using Facebook, Google etc. May not be of interest but certainly makes for a whizzy demo.!
BTW, have a look at SelfSTS. This is a STS which allows you to easily configure any type of claim you want (albeit with no authentication). Very useful for a simple claims PoC.
WIF SDK 有许多主动和被动的示例。
WIF SDK has many examples of this, active and passive.