使用 WIF 反序列化来自 RSTR 令牌的声明

发布于 2024-11-18 22:56:22 字数 1640 浏览 1 评论 0原文

我正在构建自己的 STS，它处理不同类型的协议（WS-Federation、OAuth 等）。我在处理 ADFS 2 发布到我的 STS 的 RSTR 令牌时遇到了困难。

我已成功反序列化声明的代码，但是我必须添加部分 microsoft.identityModel 配置部分才能使其正常工作，并且我需要在受信任的人员存储中添加 ADFS 2 签名证书。

我有自己的配置部分，我在其中指定内容，因此使用 microsoft.identityModel 是多余的。

代码：

    var request = System.Web.HttpContext.Current.Request;

    var message = SignInResponseMessage.CreateFromFormPost(request) as SignInResponseMessage;

    var rstr = new WSFederationSerializer().CreateResponse(message, new WSTrustSerializationContext());

    var serviceConfig = new ServiceConfiguration();

    IClaimsIdentity claimsIdentity = null;
    using (var reader = XmlReader.Create(
                                new StringReader(rstr.RequestedSecurityToken.SecurityTokenXml.OuterXml)))
    {
        var token = serviceConfig.SecurityTokenHandlers.ReadToken(reader);
        claimsIdentity = serviceConfig.SecurityTokenHandlers.ValidateToken(token).FirstOrDefault();
    }

    return claimsIdentity;

我想避免的必要配置：

<microsoft.identityModel>
    <service>
      <audienceUris mode="Never">
      </audienceUris>
      <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
        <trustedIssuers>
          <add thumbprint="27d3db77a9716ad370a7e9c632d5b98dcc5b1479" name="https://UrlToAdfs/adfs/ls/" />
        </trustedIssuers>
      </issuerNameRegistry>
    </service>
  </microsoft.identityModel>

原文

I am building my own STS which handles different kinds protocols (WS-Federation, OAuth, etc...). I got stuck handling RSTR token which is posted by ADFS 2 to my STS.

The code I have successfully deserializes the claims, however I have to add part of the microsoft.identityModel configuration section in order for it to work and I need to add the ADFS 2 signing certificate in the Trusted People store.

I have my own configuration section where I specify things so using microsoft.identityModel is redundant.

Code:

    var request = System.Web.HttpContext.Current.Request;

    var message = SignInResponseMessage.CreateFromFormPost(request) as SignInResponseMessage;

    var rstr = new WSFederationSerializer().CreateResponse(message, new WSTrustSerializationContext());

    var serviceConfig = new ServiceConfiguration();

    IClaimsIdentity claimsIdentity = null;
    using (var reader = XmlReader.Create(
                                new StringReader(rstr.RequestedSecurityToken.SecurityTokenXml.OuterXml)))
    {
        var token = serviceConfig.SecurityTokenHandlers.ReadToken(reader);
        claimsIdentity = serviceConfig.SecurityTokenHandlers.ValidateToken(token).FirstOrDefault();
    }

    return claimsIdentity;

The necessary config that I would like to avoid:

<microsoft.identityModel>
    <service>
      <audienceUris mode="Never">
      </audienceUris>
      <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
        <trustedIssuers>
          <add thumbprint="27d3db77a9716ad370a7e9c632d5b98dcc5b1479" name="https://UrlToAdfs/adfs/ls/" />
        </trustedIssuers>
      </issuerNameRegistry>
    </service>
  </microsoft.identityModel>

分享到QQ

分享到微博