如何将 SAML 身份验证集成到 WCF Web 服务应用程序中
我有一个在 IIS7 上构建和测试的 WCF Web 服务应用程序。关于身份验证，我想为访问 Web 服务中的操作的消费者实现 SQL Server 托管的用户 ID 和密码身份验证。然而，我被告知，我的公司政策要求我将 SAML 实施到我的 Web 服务中。这意味着任何访问我的 Web 服务操作的客户端都需要使用 SAML 2.0 进行身份验证。我不熟悉 SAML，但想了解并开始了解如何在我的 Web 服务中实现它。我不断听到两个术语 - 服务提供商和身份提供商，根据网络上的定义，我假设服务提供商是我的网络服务。身份提供程序是用户进行身份验证的地方，身份提供程序向我的 Web 服务提供断言，然后我让客户端访问操作。我明白了理论，但不知道如何付诸实践。访问我的 Web 服务的客户端不是内部的，即它们是外部的（外联网客户端），因此在这种情况下，身份提供者是什么以及如何向我的 Web 服务添加代码以使其成为服务提供者？
我希望您理解我的困境，任何人都可以解释我需要采取的方法，并且非常感谢任何帮助我完成网络服务的示例或教程。
I have a WCF web service application built and tested on IIS7. Regarding authentication I wanted to implement a sql server hosted userd id and password authentication for consumers accessing the operations in the web service. However I was told that my company policy dictates that I implement SAML into my web service. That means any client that is accessing my web service operations need to be authenticated using SAML 2.0. I am not familiar with SAML but like to know and get started on how to implement it within my web serivice. I keep hearing two terms - Service Provider and Identity Provider, based on definitions on the web, I am assuming the service provider is my web service. identity provider is where the user authenticates to and the identity provider provides a assertion to my web service and then I let the client access the operations. I understand the theory but not sure how to put into practical implementation. Clients accessing my web service are not internal , i.e. they are external (extranet clients), so in this case what will be the identity provider and how do I add code to my web serice to make it a service provider?
I hope you understand my dilemma, can anyone explain the approach I need to take and any samples or tutorials that help me complete the web service is greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为标准 WCF 不提供 SAML 2.0。要使其正常工作，您必须将 WCF 与 WIF（Windows 身份基础）结合起来。这里有一个使用 WCF 与 WIF 和基于声明的授权的非常复杂的示例 。该示例使用 SAML 1.1，但仅更改配置即可使其与 SAML 2.0 一起使用。
您的问题通常称为联合身份验证或联合身份，其中用户根据 STS（服务令牌服务）进行身份验证并接收安全令牌（例如可以是 SAML 令牌）。比客户端调用实际服务（RP - 中继方）传递其安全令牌。那么你要建造什么？如果您的公司政策要求使用 SAML，那么他们很可能已经拥有 STS，您只需按照本文所述通过 SAML 令牌对客户端进行身份验证即可。
I think SAML 2.0 is not provided by standard WCF. To make it work you must combine WCF with WIF (Windows identity foundation). Here you have very complex example of usage WCF with WIF and claim based authorization. The example uses SAML 1.1 but it is only configuration change to make it work with SAML 2.0.
Your problem is generally called Federated authentication or Federated identity where user authenticates against STS (service token service) and it receives security token (it can be for example SAML token). Than the client calls real service (RP - relaying party) where it passes its security token. So what are you going to build? If your company policy demands SAML usage they most probably already have STS and you just need to authenticate clients by SAML tokens as mentioned in the article.
自 2011 年以来，对声明感知 WCF 服务的支持已明显改进 .NET 4.5 发布。我将复制该文章中的信息，以防它发生变化，但截至本回答时，该过程似乎很简单：
添加对 WIF 的引用（
Microsoft.IdentityModel.dll< /code>) 在您的 WCF 服务项目中。由于这是随 .NET 4.5 一起提供的，因此我认为不需要 NuGet 包。使用以下代码示例创建自托管声明感知服务：
var host = new ServiceHost(typeof(ClaimsAwareWebService), new Uri("myUri"));
FederatedServiceCredentials.ConfigureServiceHost(主机);
host.Open();
将您的 WCF 服务设置为使用
federatedServiceHostConfiguration行为扩展。Since 2011, support for Claims-Aware WCF Services has apparently improved with the release of .NET 4.5. I'll copy info from that article in case it ever changes, but as of the time of this answer, the process appeared to be as simple as:
Adding a reference to WIF (
Microsoft.IdentityModel.dll) in your WCF Service project. Since this is delivered with .NET 4.5, I do not believe a NuGet package is necessary.Use the following code sample to create a self-hosted Claims-Aware service:
var host = new ServiceHost(typeof(ClaimsAwareWebService), new Uri("myUri"));
FederatedServiceCredentials.ConfigureServiceHost(host);
host.Open();
Set your WCF service to use the
federatedServiceHostConfigurationBehavior Extension.