WIF ActAs 구현 시나리오 : 보내는 메시지에 대해 ID 확인이 실패했습니다.

Question

그래서 웹 사이트에서 WCF 서비스를 사용하고 사이트가 STS에서 서비스로 가져온 IClaimsIdentity를 전달하려고합니다.

내가 ActAs 채널을 통해 서비스 메소드를 호출하려고

, 내가 클라이언트에서 다음과 같은 오류 얻을 (추적 로그를보고,이 서비스에 도달하지, 그리고 STS가 올바르게 모든 토큰을 통해 전송) :

발신 메시지의 신원 확인에 실패했습니다. 예상 된 ID는 'ID (http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprint)'이고 의 경우 'http : //localhost/MyWCFHost/MyService.svc '목표 종점.

사용자 지정 IssuedTokenForCertificate 바인딩이 있는데 모든 인증서가 정상적으로 작동하는 한 정상적으로 작동하지만 정상적으로 작동합니다.

이 웹 사이트 구성 소비 : 내 설정 찾고 돕는 눈을 또 한 쌍 감사하겠습니다

<system.serviceModel> 
    <bindings> 
     <customBinding> 
     <binding name="CustomBinding_IMyService"> 
      <security defaultAlgorithmSuite="Default" authenticationMode="IssuedTokenForCertificate" 
      requireDerivedKeys="true" includeTimestamp="true" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10" 
      requireSignatureConfirmation="true"> 
      <issuedTokenParameters tokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"> 
       <additionalRequestParameters> 
       <trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"> 
        <trust:TokenType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1</trust:TokenType> 
        <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType> 
       </trust:SecondaryParameters> 
       </additionalRequestParameters> 
       <issuer address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc" 
       binding="ws2007HttpBinding" bindingConfiguration="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc"> 
       </issuer> 
       <issuerMetadata address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc/mex" /> 
      </issuedTokenParameters> 
      <localClientSettings detectReplays="true" /> 
      <localServiceSettings detectReplays="true" /> 
      </security> 
      <textMessageEncoding /> 
      <httpTransport /> 
     </binding> 
     </customBinding> 
     <ws2007HttpBinding> 
     <binding name="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc"> 
      <security> 
      <message establishSecurityContext="false" /> 
      </security> 
     </binding> 
     </ws2007HttpBinding> 
    </bindings> 
    <client> 
     <endpoint address="http://localhost/MyWCFHost/MyService.svc" binding="customBinding" 
     bindingConfiguration="CustomBinding_IMyService" contract="MyService.IMyService" 
     name="CustomBinding_IMyService"> 
     <identity> 
      <!--<certificate encodedValue="AwAAAAEAAAAUAAAAV2ILlfzl9NIHEiGv1rUCSitq8I0gAAAAAQAAAP8BAAAwggH7MIIBaKADAgECAhBTTBmG1HyUkEDVFmVUxfDLMAkGBSsOAwIdBQAwFTETMBEGA1UEAxMKRXRhbmEgUm9vdDAeFw0xMjA5MjExMjE2MDRaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBgNVBAMTFEV0YW5hIFNUUyBFbmNyeXB0aW9uMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0lbzr1b1aNiXGhwKMTO58QbLbbKoUtTRkA4egMlmip1Vm46BnscWAMvXA5kyzuqK6Cw/5bel15i0pZXR4kjByKbSr65V0/ODGrkUHaYb5vT8RzCczYcgzJmPGWawMYYJT8PXLXHkFmZZGXFZhiUBzyNMWh8YH16I/wFtUgmaBAQIDAQABo0owSDBGBgNVHQEEPzA9gBAV68U+Vhoc0Nu9qPJXfJSRoRcwFTETMBEGA1UEAxMKRXRhbmEgUm9vdIIQgnOTDbZVCaJFTK8PPAGynTAJBgUrDgMCHQUAA4GBACHLr32oqkFjKGN/fqk2VnsNNIs9niHQ4Q6UbJ252YWf4wFIz9Ho/+ZdFxC4tSHxa/IMH0kzYpRL5p61Zd8/QeryWCStqvoNPwyapaY3g0Pkm6dy6NJ82kX5eJxLjdJp8MVadPJs4VA7Smf+e9lMMoONAGP07AvzAVhtiYK2yMmH" />--> 
      <certificateReference findValue="57620B95FCE5F4D2071221AFD6B5024A2B6AF08D" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" /> 
     </identity> 
     </endpoint> 
    </client> 
    </system.serviceModel> 

WCF 서비스를 설정 : 바인딩을 변경하여 내 문제를

<system.serviceModel> 
    <diagnostics> 
     <messageLogging logMalformedMessages="true" logMessagesAtTransportLevel="true" /> 
    </diagnostics> 
    <services> 
     <service name="RPWCFApp.MyService" behaviorConfiguration="MyServiceBehaviour"> 
     <endpoint address="" binding="customBinding" bindingConfiguration="CustomBindingConfiguration_IssuedTokenOverTransport" contract="RPWCFApp.IMyService" /> 
     <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /> 
     </service> 
    </services> 
    <behaviors> 
     <serviceBehaviors> 
     <behavior name="MyServiceBehaviour"> 
      <federatedServiceHostConfiguration /> 
      <serviceMetadata httpGetEnabled="true" /> 
      <serviceDebug includeExceptionDetailInFaults="false" /> 
      <serviceCredentials> 
      <serviceCertificate findValue="81A5DB3796F48B00FAC37CE67D7D8CA43078B996" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" /> 
      </serviceCredentials> 
     </behavior> 
     </serviceBehaviors> 
    </behaviors> 
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" /> 
    <extensions> 
     <behaviorExtensions> 
     <add name="federatedServiceHostConfiguration" type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /> 
     </behaviorExtensions> 
    </extensions> 

    <bindings> 
     <customBinding> 
     <binding name="CustomBindingConfiguration_IssuedTokenOverTransport"> 
      <security authenticationMode="IssuedTokenForCertificate" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"> 
      <issuedTokenParameters keyType="SymmetricKey" tokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"> 
       <issuer address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc" binding="ws2007HttpBinding" bindingConfiguration="IssuedTokenBinding" /> 
       <issuerMetadata address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc/mex" /> 
      </issuedTokenParameters> 
      </security> 
      <textMessageEncoding /> 
      <httpTransport /> 
     </binding> 
     </customBinding> 
     <ws2007HttpBinding> 
     <binding name="IssuedTokenBinding"> 
      <security mode="TransportWithMessageCredential"> 
      <message clientCredentialType="Windows" establishSecurityContext="false" /> 
      </security> 
     </binding> 
     </ws2007HttpBinding> 
    </bindings> 
    </system.serviceModel> 

Answer 1

을 정렬 서비스 구성에서 CustomBinding 대신 ws2007FederationHttpBinding을 사용하고 클라이언트 서비스 참조를 업데이트하십시오. 그런 다음

<bindings> 
    <ws2007FederationHttpBinding> 
    <binding name="serviceBinding" receiveTimeout="05:00:00" sendTimeout="05:00:00"> 
     <security mode="Message"> 
     <message> 
      <issuerMetadata address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc/mex"/> 
     </message> 
     </security> 
    </binding> 
    </ws2007FederationHttpBinding> 
</bindings> 

I는 자체 서명 된 인증서를 사용하고 있기 때문에, 나는 클라이언트 설정에서 다음과 같은 엔드 포인트 동작을 사용하여 certificateValidationMode을 변경했다 :

<behaviors> 
    <endpointBehaviors> 
    <behavior name="MyServiceBehavior" > 
     <clientCredentials> 
     <serviceCertificate> 
      <authentication certificateValidationMode="PeerOrChainTrust"/> 
     </serviceCertificate> 
     </clientCredentials> 
    </behavior> 
    </endpointBehaviors> 
</behaviors> 

그리고 마지막으로 난 그냥 내 인증서를 확인했다 ... 신뢰할 수있는 사람들 저장소에이고 서비스 :이 밖에 누군가가 도움이

희망을 호출 할 때 잠시 동안 나에게 견과를 몰았다 때문에 결국 나는 올바른 IClaimsIdentity를 얻을 수