将 ADFS 令牌从客户端发送到 WCF 服务答案

【问题标题】：Send ADFS Token From Client to a WCF Service将 ADFS 令牌从客户端发送到 WCF 服务
【发布时间】：2011-11-12 01:02:50
【问题描述】：

我有一个要求，我的 Silverlight 应用程序需要连接到 WCF 服务以通过中间 WCF 服务获取数据，该服务托管在与 Silverlight 相同的域中。也就是说，Silverlight 将调用中间服务，中间服务会将 IssuedToken 与请求一起附加，并将其发送到主 WCF 客户端。主 WCF 服务将从 Thread.Principal 检索声明。

    var binding = new WS2007FederationHttpBinding(WSFederationHttpSecurityMode.TransportWithMessageCredential);
    binding.Security.Message.EstablishSecurityContext = false;

    var factory = new ChannelFactory<IMyService>(binding, new EndpointAddress("https://myservice.cloudapp.net:4432/MyService.svc"));
    var channel = factory.CreateChannelActingAs(((ClaimsIdentity)((ClaimsPrincipal)HttpContext.Current.User).Identity).BootstrapToken);

    var data = channel.GetData();

但是这段代码失败了。我找不到有关如何实现此目的的财产文档。谁能帮我解决这个问题。

谢谢，

【问题讨论】：

标签： .net silverlight wcf azure adfs2.0

【解决方案1】：

您需要： 1.对ADFS STS服务进行身份验证，获取SecurityToken 2. 使用“CreateChannelWithIssuedToken”查询你的服务，如下：

        var token = GetToken();

        string uri = SERVICE_URL;

        EndpointAddress address = new EndpointAddress(uri);

        var binding = new WS2007FederationHttpBinding(WSFederationHttpSecurityMode.TransportWithMessageCredential);
        binding.Security.Message.EstablishSecurityContext = false;

        _factory = new ChannelFactory<IService>(binding, address);
        _factory.ConfigureChannelFactory<IService>();
        _factory.Credentials.SupportInteractive = false;

        _service = _factory.CreateChannelWithIssuedToken<IService>(token);

GetToken 的代码如下所示：

    public static SecurityToken GetToken(string username, string password, EndpointAddress federationServiceProxyAddress, EndpointAddress relyingPartyIdentifier)
    {
        var binding = new UserNameWSTrustBinding
        {
            SecurityMode = SecurityMode.TransportWithMessageCredential
        };

        var factory = new WSTrustChannelFactory(binding, federationServiceProxyAddress)
        {
            TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13,
        };

        factory.Credentials.SupportInteractive = false;
        factory.Credentials.UserName.UserName = username;
        factory.Credentials.UserName.Password = password;

        try
        {
            var requestSecurityToken = new RequestSecurityToken
            {
                RequestType = WSTrust13Constants.RequestTypes.Issue,
                AppliesTo = relyingPartyIdentifier
            };

            var channel = factory.CreateChannel();
            return channel.Issue(requestSecurityToken);//, out requestSecurityTokenResponse);
        }
        catch (MessageSecurityException exception)
        {
            // Invalid username or password
            throw new MessageSecurityException(exception.Message, exception);
        }
        catch (Exception exception)
        {
            // Unknown error
            throw new Exception(exception.Message, exception);
        }
        finally
        {
            try
            {
                if (factory.State == CommunicationState.Faulted)
                {
                    factory.Abort();
                }
                else
                {
                    factory.Close();
                }
            }
            catch (Exception) { }
        }
    }

希望这会有所帮助...

【讨论】：