将 SAML 令牌传递到 Web api 调用

Question

我有一个通过 ADFS 进行身份验证的 Web 应用程序和 Web api 服务。它们包含在同一个 IIS 应用程序中，Web 应用程序可以毫无问题地回调 Web api 服务。

我现在正尝试从不同的应用程序调用相同的服务，但在传递令牌时遇到了问题。我可以使用以下代码验证和检索 SAML 令牌：

var stsEndpoint = "https://MyAdfsServer/adfs/services/trust/13/UsernameMixed";
var reliantPartyUri = "https://MyDomain/AppRoot/";

var factory = new Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannelFactory(
            new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
            new EndpointAddress(stsEndpoint));

factory.TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13;

// Username and Password here...
factory.Credentials.UserName.UserName = @"Domain\UserName";
factory.Credentials.UserName.Password = "Password";

var rst = new RequestSecurityToken
    {
        RequestType = RequestTypes.Issue,
        AppliesTo = new EndpointAddress(reliantPartyUri),
        KeyType = KeyTypes.Bearer,
    };

var channel = factory.CreateChannel();
var token = channel.Issue(rst) as GenericXmlSecurityToken;

var saml = token.TokenXml.OuterXml;

但是，我不确定如何将 saml 传递给 web api 调用。我试过这个：

using (var handler = new HttpClientHandler() 
    { 
        ClientCertificateOptions = ClientCertificateOption.Automatic,
        AllowAutoRedirect = false
    })
{
    using (var client = new HttpClient(handler))
    {
        client.BaseAddress = new Uri("https://MyDomain/AppRoot/api/");

        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("SAML", saml);

        HttpResponseMessage response = client.GetAsync("MyService/Get/").Result;

        // Get the results...
        var result = response.Content.ReadAsStringAsync().Result;
        var status = response.StatusCode;
    }
}

这将返回状态代码 302 并尝试将我重定向到 ADFS 服务器进行身份验证。还有其他方法可以将 SAML 令牌传递给 Web api 服务吗？

Answer 1

（设置）

            string samlString = "blah blah blah";

            byte[] bytes = Encoding.UTF8.GetBytes(samlString);

            string base64SamlString = Convert.ToBase64String(bytes);

            myHttpClient.DefaultRequestHeaders.Add("X-My-Custom-Header", base64SamlString);

（获取）

        IEnumerable<string> headerValues = request.Headers.GetValues("X-My-Custom-Header");

        if (null != headerValues)

        {

            var encoding = Encoding.GetEncoding("iso-8859-1");

            string samlToken = encoding.GetString(Convert.FromBase64String(headerValues.FirstOrDefault()));

        }

Answer 2

当您想要访问受 SSO 保护的资源（我假设是 ADFS）时，我发现使用以下方法最容易：显示 WebBrowser 元素，让用户输入凭据，然后获取全局 cookie，然后将它们传递给执行实际 HTTP 操作的新 HttpClient。

这是一个完整的代码示例，它从受 SAML 保护的 Jenkins 服务器下载所有构建状态：

private void Start()
{
    var t = new Thread(ThreadProc);
    t.SetApartmentState(ApartmentState.STA);
    t.Start();
    t.Join();
}

public async void ThreadProc()
{
    try
    {
        var urlBase = "https://JENKINS/";
        var url = urlBase + "job/JOBNAME/api/json?depth=1&tree=lastBuild[timestamp],builds[number,result,timestamp,url,actions[lastBuiltRevision[SHA1,branch[name]],totalCount,failCount,skipCount],building,duration]";

        var form = new Form();
        var browser = new System.Windows.Forms.WebBrowser();

        browser.SetBounds(0, 0, 400, 400);
        form.Size = new System.Drawing.Size(400, 400);
        form.Controls.AddRange(new Control[] { browser });
        form.FormBorderStyle = FormBorderStyle.FixedDialog;
        form.StartPosition = FormStartPosition.CenterScreen;
        form.MinimizeBox = false;
        form.MaximizeBox = false;

        // Navigate to base URL. It should internally forward to login form. After logging in, close browser window.
        browser.Navigate(urlBase);
        form.ShowDialog();

        var cookieString = GetGlobalCookies(urlBase);
        var cookieContainer = new System.Net.CookieContainer();
        using (var handler = new HttpClientHandler() { CookieContainer = cookieContainer })
        using (var client = new HttpClient(handler) { BaseAddress = new Uri(urlBase, UriKind.Absolute) })
        {
            cookieContainer.SetCookies(client.BaseAddress, cookieString);
            var response = await client.GetAsync(url);
            if (response.IsSuccessStatusCode)
            {
                var responseStream = await response.Content.ReadAsStreamAsync();
                using (var reader = new System.IO.StreamReader(responseStream))
                {
                    var responseString = await reader.ReadToEndAsync();
                }
            }
        }
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex);
    }
}

[System.Runtime.InteropServices.DllImport("wininet.dll", CharSet = System.Runtime.InteropServices.CharSet.Auto, SetLastError = true)]
private static extern bool InternetGetCookieEx(string pchURL, string pchCookieName,
    System.Text.StringBuilder pchCookieData, ref uint pcchCookieData, int dwFlags, IntPtr lpReserved);

private const int INTERNET_COOKIE_HTTPONLY = 0x00002000;

public string GetGlobalCookies(string uri)
{
    uint uiDataSize = 2048;
    var sbCookieData = new System.Text.StringBuilder((int)uiDataSize);
    if (InternetGetCookieEx(uri, null, sbCookieData, ref uiDataSize,
            INTERNET_COOKIE_HTTPONLY, IntPtr.Zero)
        &&
        sbCookieData.Length > 0)
    {
        return sbCookieData.ToString().Replace(";", ",");
    }
    return null;
}