我有一个通过 ACS 使用用户名身份验证的 WCF 服务。当我使用服务标识时，这非常有效，但是当我尝试使用 Windows Live ID 凭据时，我收到以下错误：
System.ServiceModel.FaultException：ACS10002：处理 SOAP 正文时发生错误。 ACS50012：身份验证失败。 ACS50026：名称为“[email protected]”的主体不是已知主体。
不幸的是，我还没有找到如何将 Windows Live ID 与 WCF 服务结合使用的示例。我能找到的唯一示例似乎集中于将多个身份提供商与 ASP.NET 或 MVC 网站集成。
在这方面的任何帮助将不胜感激......
I have a WCF service that uses UserName authentication via ACS. This works great when I'm using Service Identities but when I try to use my Windows Live ID credentials I get the following error:
System.ServiceModel.FaultException: ACS10002: An error occurred while processing the SOAP body. ACS50012: Authentication failed. ACS50026: Principal with name '[email protected]' is not a known principal.
Unfortunately I've yet to find an example of how one uses Windows Live ID with a WCF service. The only examples I could find seem to be focused on integrating multiple identity providers with ASP.NET or MVC websites.
Any help in this regard would be greatly appreciated....
发布评论
评论（1）
ACS 不会直接验证您的 Live ID 用户名和密码。 ACS 充当 Live ID 的联合提供者，它是一个中间人，因此它只会消耗 Windows Live ID 颁发的令牌。 ACS 在基于被动（浏览器重定向）的方案中支持开箱即用的 Live ID 身份验证，但对于 WCF 服务，您可能会考虑使用 Live Connect API。
要将 LiveID 与您的服务一起使用，您的客户端首先向 LiveID 验证自身身份，然后向您的 WCF 服务提供 LiveID 颁发的令牌。不过请做好准备，要完成这一切，需要克服一些困难。
要使用 Live Connect API，您需要将 WCF 服务注册为具有 Live ID 的应用程序。使用 WCF 服务的客户端需要能够处理 Live ID 将提示的基于 Web 的登录页面和用户同意页面。下面的文档是一个好的开始
http://msdn.microsoft.com/en- us/library/hh243641.aspx
http://msdn.microsoft.com/en-us/library/hh243647.aspx
http://msdn.microsoft.com/en-us/library/windows/apps/hh465098.aspx
下一个问题是您从 Live Connect 获得的令牌将位于 JWT 中（JSON Web 令牌）格式。我不确定您是否可以从实时连接请求不同的令牌格式，但如果您的 WCF 服务身份验证是基于 WIF 的，则它很可能需要 SAML 令牌。 JWT 是一种相当新的令牌格式，WIF 尚不支持，因此您必须在服务上配置一个能够理解 JWT 令牌的 WIF SecurityTokenHandler。上面的第三个链接有一些用于读取 JWT 的代码，这至少是一个开始。
ACS won't authenticate your Live ID username and password directly. ACS acts as a federation provider for Live ID, it's a go-between, so it will only consume tokens issued by Windows Live ID. ACS supports Live ID authentication out of the box in passive (browser redirect) based scenarios but for a WCF service you might consider using Live Connect APIs instead.
To use LiveID with your service, your client first authenticates itself to LiveID, and then presents a LiveID-issued token to your WCF service. Brace yourself though, there would be some hoops to jump through to set all of this up.
To use the Live Connect APIs, you would register your WCF service as an application with Live ID. Clients that consume your WCF service would then need to be capable of handling the web based login page and user consent pages that Live ID will prompt. The docs below are a good start
http://msdn.microsoft.com/en-us/library/hh243641.aspx
http://msdn.microsoft.com/en-us/library/hh243647.aspx
http://msdn.microsoft.com/en-us/library/windows/apps/hh465098.aspx
The next problem is the token you'll get from Live Connect will be in JWT (JSON Web Token) format. I'm not sure if you can request a different token format from live connect, but if your WCF service authentication is WIF based, it most likely expects SAML tokens. JWT is a rather new token format that WIF doesn't yet support so you would have to configure a WIF SecurityTokenHandler on your service that understands JWT tokens. The third link above has some code for reading JWTs, which is a start at least.