日内瓦框架中RP-STS的简单索赔转换

我在日内瓦论坛上也问了同样的问题 http://social.msdn.microsoft.com/Forums/en/Geneva/thread/d10c556c-1ec5-409d-8c25-bee2933e85ea?prof=required 得到回复:

嗨,多基,

当我读到那篇文章时,我也在想同样的事情。在我思考如何实现这样一个场景时,我提出了两个想法:

1. RP实际上被配置为需要来自RP-STS的声明;RP-STS需要来自IP-STS的安全令牌。因此,当受试者请求RP资源时,它会将他反弹到RP-STS,后者会将他反弹到IP-STS。在那里进行身份验证之后,他将被退回RP-STS,以身份为中心的声明将被转换为作出授权决策所必需的声明,并返回RP。

2. RP被配置为有一个拦截器(例如,如果它是一个WCF服务,则有一个authorizationpolicy)来捕获调用,查看以身份为中心的声明,创建一个RST(使用wstrustclient),将其传递给RP-STS,该服务将声明扩展为返回到RP的新声明,并且RP做出授权决定。

我从来没有实现过这一点,但是,如果我要实现这一点,我会进一步探讨这两个想法。

嗯!

当做,

特拉维斯斯宾塞

所以我将首先尝试选项2,看看是否可行,然后在这里制定一个答案。

我的第一种情况很好。 在我的例子中,ad fs是身份服务,而自定义sts是资源sts。

所有webapp都使用相同的资源sts,但是在用户访问其他应用程序之后,与身份相关的声明不会被ad fs再次添加,因为用户已经过身份验证。我如何才能再次强制或请求AD FS的基本声明?

我用actas创建了一个对ad fs的调用,现在它返回我的身份声明。 请记住,为用于调用AD FS的凭据启用允许委派的规则。

string stsEndpoint = "https://<ADFS>/adfs/services/trust/2005/usernamemixed";
     var trustChannelFactory = new WSTrustChannelFactory(new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential), stsEndpoint);

     trustChannelFactory.Credentials.UserName.UserName = @"DELEGATE";
     trustChannelFactory.Credentials.UserName.Password = @"PASSWORD";

     trustChannelFactory.TrustVersion = TrustVersion.WSTrustFeb2005;

     //// Prepare the RST.
     //var trustChannelFactory = new WSTrustChannelFactory(tokenParameters.IssuerBinding, tokenParameters.IssuerAddress);
     var trustChannel = (WSTrustChannel)trustChannelFactory.CreateChannel();

     var rst = new RequestSecurityToken(RequestTypes.Issue);

     rst.AppliesTo = new EndpointAddress(@"https:<RPADDRESS>");

     // If you're doing delegation, set the ActAs value.
     var principal = Thread.CurrentPrincipal as IClaimsPrincipal;
     var bootstrapToken = principal.Identities[0].BootstrapToken;

     // The bootstraptoken is the token received from the AD FS after succesfull authentication, this can be reused to call the AD FS the the users credentials
     if (bootstrapToken == null)
     {
        throw new Exception("Bootstraptoken is empty, make sure SaveBootstrapTokens = true at the RP");
     }

     rst.ActAs = new SecurityTokenElement(bootstrapToken);

     // Beware, this mode make's sure that there is no certficiate needed for the RP -> AD FS communication
     rst.KeyType = KeyTypes.Bearer;

     // Disable the need for AD FS to crypt the data to R-STS
     Scope.SymmetricKeyEncryptionRequired = false;

     // Here's where you can look up claims requirements dynamically.
     rst.Claims.Add(new RequestClaim(ClaimTypes.Name));
     rst.Claims.Add(new RequestClaim(ClaimTypes.PrimarySid));

     // Get the token and attach it to the channel before making a request.
     RequestSecurityTokenResponse rstr = null;
     var issuedToken = trustChannel.Issue(rst, out rstr);
     var claims = GetClaimsFromToken((GenericXmlSecurityToken)issuedToken);

 private static ClaimCollection GetClaimsFromToken(GenericXmlSecurityToken genericToken)
  {
     var handlers = FederatedAuthentication.ServiceConfiguration.SecurityTokenHandlers;
     var token = handlers.ReadToken(new XmlTextReader(new StringReader(genericToken.TokenXml.OuterXml)));
     return handlers.ValidateToken(token).First().Claims;
  }