Windows 身份基础仅适用于内部应用程序/网站？
我现在花了相当长的时间研究Windows Identity Foundation。我什至在 MSDN 上读过一本关于它的书的几个章节。
但我仍然对一件事感到困惑。 WIF 是否适合面向公众的网站身份验证，或者主要针对 Intranet/sharepoint 站点（处理由集成识别的用户的内部域） windows auth/active Directory 或类似的东西。目前，我们公司有许多网站，人们可以使用表单身份验证/自定义 asp.net 会员提供程序登录并根据数据存储进行身份验证。是否可以用WIF替代这个机制？如果是这样，有人有此类教程的链接吗？
我尝试过沿着这些线索寻找任何信息，但很难找到。
I have spent quite some time now looking at the Windows Identity Foundation. I even read a few chapters of a book on it on MSDN.
But I'm still confused about one thing. Is WIF appropriate for a public facing web site authentication or is this mainly targeted towards intranets/sharepoint sites, something that deals with internal domain where users are identified by integrated windows auth/active directory or something like that. Currently, we have many web sites for our company where people log in and are authenticated against a data store using forms authentication/custom asp.net membership provider. Is it possible to replace this mechanism with WIF? if so, does anyone have a link to such a tutorial.
I have tried looking for any information along these lines but it has been hard to find.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
原则上，Windows Identity Foundation 并不适合在“面向公众”的网站上使用，而且 WIF 本身也不与特定的身份验证机制绑定。但是，如果您正在考虑使用 Active Directory 联合服务作为您的身份提供程序，则问题是根据 AD 对用户进行身份验证将是您唯一的选择，因为这就是它支持的全部内容（尽管您可以插入自定义属性存储来从某些身份验证中检索声明值）。其他数据存储）。不过，您的 WIF 依赖方（即您的网站）不一定关心用户的身份验证方式，只关心用户是由其信任的 IDP 进行身份验证的。
因此，您的问题可能不是“启用 WIF”网站本身的问题，更可能是找到一个兼容的 IDP 的问题，该 IDP 支持针对 Active Directory 以外的其他内容进行身份验证，以便您可以使用当前使用的数据存储来进行身份验证。对用户进行身份验证。可以使用 ADFS 作为 WIF 依赖方和 SAML2 IDP 之间的“桥梁”（依赖方安全令牌服务器），例如 Shibboleth 可以使用数据库对用户进行身份验证，但配置这样的系统是一项重大挑战，因此您必须权衡用户通过单点登录应用程序可能获得的好处与大量建立和维护这样一个系统需要付出努力。
In principle, there's nothing about Windows Identity Foundation that makes it inappropriate for use on a "public-facing" website and WIF isn't in-itself tied to a particular authentication mechanism either. However, if you were considering using Active Directory Federated Services as your Identity Provider the problem would be that authenticating users against AD would be your only option since that's all it supports (although you can plug in a custom attribute store that retrieves claim values from some other datastore). Your WIF relying-party (i.e. your website) doesn't necessarily care how the user was authenticated, though, only that they were authenticated by an IDP that it trusts.
So your problem might not be that of "WIF-enabling" the websites as such, it may be more a question of finding a compatible IDP that supports authenticating against something other than Active Directory so that you can use the data store you currently use to authenticate users. It is possible to use ADFS as a "bridge" (a Relying-Party Security Token Server) between your WIF relying party and a SAML2 IDP like Shibboleth which can use a database to authenticate users, but configuring such a system is a significant challenge so you'd have to weigh up the benefits that your users might gain from single sign-on to your applications against the considerable effort it would take to set up and maintain such a system.
是 - WIF 适用于面向公众的网站身份验证。 ADFS v2.0 仅针对 AD 进行身份验证。但是，您可以编写一个自定义 STS，根据您喜欢的任何内容进行身份验证。对于您的情况，如果使用数据存储，请查看针对 SQL DB 进行身份验证的 Identity Server。
看看：
http://claimsid.codeplex.com/
身份培训套件
如何：构建 ASP.NET STS
Yes - WIF appropriate for public facing web site authentication. ADFS v2.0 only authenticates against AD. However, you can write a custom STS that authenticates against anything you like. In your case, with a data store, have a look at Identity Server which authenticates against a SQL DB.
Have a look at:
http://claimsid.codeplex.com/
Identity Training Kit
How to: Build an ASP.NET STS