是否可以实施 SSO 服务（自定义 STS、WIF）以使其具有高可用性（集群或在网络场中）？
我最近在这里问了一个问题：使用 WIF 在 .NET Web Farm 中为多个电子商务网站实现 SSO？ 概述了我的下一个问题背后的详细信息。
问题/解决方案的简要总结是，可以使用 WIF 和自定义 STS 来实现一系列需要 SSO 解决方案的网站，以根据某种 SQLMembershipProvider 验证用户。在为该系统开发图表时，出现了另一个问题。
Web 场中 Web 服务器的想法背后的目的是消除网站的单点故障 (SPOF)，从而实现更可靠的服务交付。数据库服务器和电子邮件服务器的类似策略已有详细记录。是否可以使用自定义 STS 和 WIF 实施 SSO 解决方案，而不在现有高可用环境中引入单点故障？为了消除此 SPOF，需要实施哪些额外步骤/策略？
或多或少的问题是：
- 可以将自定义STS放入负载平衡环境中吗？
- 是否可以将 WIF 放入负载平衡环境中（不使用 Azure 等第三方实现）？
- 为了实现这一目标需要解决哪些具体技术问题（或者是否可以像 Web 服务器一样完成）？
- 这是个好主意吗？有哪些潜在问题？
我在网上做了很多研究，但无法找到这个问题的完整答案。我对基于声明的身份验证和联合身份仍然很陌生，所以如果我含糊或迟钝，请原谅我。
我是否想在圆孔中安装一个方钉？
如果您需要任何说明，请告诉我。
I recently asked a question here: Implementing SSO in a .NET Web Farm for several e-commerce websites with WIF? that outlines the details behind my next question.
A brief summary of the question/solution is that a series of web sites needing a SSO solution could be implemented using WIF with a custom STS to validate users against a SQLMembershipProvider of some kind. In developing a diagram for this system, another issue presented itself.
The purpose behind the idea of web servers in a web farm is to eliminate a single point of failure (SPOF) for the websites resulting in a more reliable delivery of service. Similar strategies are well documented for database servers and e-mail servers. Is it possible to implement a SSO solution without introducing a single point of failure into an existing highly available environment using a custom STS and WIF? What additional steps / strategies would need to be implemented in order to remove this SPOF?
More or less the questions are:
- Can a custom STS be placed into a load-balanced environment?
- Can WIF be placed into a load-balanced environment (without using a third party implementation like Azure)?
- What are the specific technological issues that would need to be addressed in order to accomplish this (or could it be done in the same way that web servers are)?
- Is this AT ALL a good idea? What are some potential issues?
I have done quite a bit of research online and am unable to find a complete answer to this question. I am still new to claims based authentication and federated identities so forgive me if I am vague or obtuse.
Am I trying to fit a square peg in a round hole?
Please let me know if you need any clarification.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
•可以将自定义STS 放入负载平衡环境中吗？
是的 - 尽管您可能需要“粘性会话”
•可以将 WIF 放入负载平衡环境中（不使用 Azure 等第三方实施）吗？
WIF 只是一组作为引用添加到 VS 项目中的 .NET 类。它使应用程序能够声明。您无法“单独”部署 WIF。您部署支持声明的应用程序。
• 为了实现这一目标需要解决哪些具体技术问题（或者是否可以像网络服务器那样完成）？
对于具有服务器场的 ADFS：
“辅助联合服务器存储来自主联合服务器的 AD FS 配置数据库的副本，但这些副本是只读的。辅助联合服务器通过定期轮询连接到场中的主联合服务器并与主联合服务器同步数据检查数据是否已更改。辅助联合服务器的存在是为了为主联合服务器提供容错能力，同时对整个网络环境中不同站点中发出的访问请求进行负载平衡。”
不确定其中有多少是 AFDS 功能，有多少是标准 SQL Server 功能？您可以使用 SQL Server 配置两个或多个服务器作为服务器集群一起工作，以确保您的自定义 STS 高度可用，可以为传入的客户端请求提供服务。
•这是个好主意吗？有哪些潜在问题？
根据记忆，我们遇到的唯一问题是“粘性会话”问题。
另请参阅ADFS 2.0 高可用性和高弹性演练
更新：看看 Windows Identity Foundation 编程。问题在于 WIF 会话 cookie 受机器密钥保护。 Vittorio 建议：
书中有一节介绍了开发自定义 STS。我推荐它。
•Can a custom STS be placed into a load-balanced environment?
Yes - although you may need "sticky sessions"
•Can WIF be placed into a load-balanced environment (without using a third party implementation like Azure)?
WIF is just a set of .NET classes that is added as a reference in a VS project. It enables the application to be claims-enabled. You can't deploy WIF "on its own". You deploy the claims-enabled application.
•What are the specific technological issues that would need to be addressed in order to accomplish this (or could it be done in the same way that web servers are)?
For ADFS with a server farm:
"Secondary federation servers store a copy of the AD FS configuration database from the primary federation server, but these copies are read-only. Secondary federation servers connect to and synchronize the data with the primary federation server in the farm by polling it at regular intervals to check whether data has changed. The secondary federation servers exist to provide fault tolerance for the primary federation server while acting to load-balance access requests that are made in different sites throughout your network environment."
Not sure how much of this is AFDS functionality and how much is standard SQL Server functionality? You can use SQL Server to configure two or more servers to work together as a server cluster to ensure that your custom STS is made highly available to service incoming client requests.
•Is this AT ALL a good idea? What are some potential issues?
From memory, the only issue we came across was the issue of "sticky sessions".
Also, refer ADFS 2.0 High Availability and High Resiliency Walkthrough
Update: Have a look at Programming Windows Identity Foundation. The issue is that WIF session cookies are protected by the machine key. Vittorio suggests:
There's a section in the book about developing custom STS. I recommend it.
您没有理由不能将自定义 STS 部署到网络场中。被动联合端点只是一个网站，您的 WIF 依赖方在需要进行身份验证时将重定向到该网站。因此，您只需将 STS 网站的多个实例部署到网络场中即可。
正如 nzpcmad 所提到的，您将需要在负载平衡环境中的依赖方应用程序之间同步计算机密钥。由于 SAML 令牌是使用机器密钥加密的，因此应用程序需要使用相同的密钥对其进行解密。
查看其他回复。
是的，高可用性和冗余是一个非常好的主意。 ADFS 具有在网络场中工作的内置功能，但对于自定义 STS，您只需要确保 STS 的配置在服务器之间保持一致。如果可能的话，我建议将配置存储在数据库中。
There's no reason you can't deploy a custom STS into a web farm. The passive federation endpoint is simply a website that your WIF relying party will redirect to when it needs to authenticate. Therefore you would simply deploy multiple instances of the STS web site into the web farm.
As nzpcmad mentioned, you will need to synchronize machine keys between your relying party applications in the load balanced environment. Since the SAML token is encrypted using the machine key, the application needs to decrypt it using the same key.
See other responses.
Yes, high availability and redundancy are a very good idea. ADFS has built-in capabilities for working in a web farm, but for a custom STS you'll just need to make sure the configuration for your STS is consistent between servers. I would recommend storing the configuration in a database if possible.