WCF 서비스를 호출하는 패시브 웹 응용 프로그램

Question

ADFS 2.0을 사용하는 수동 RP 인 ASP.NET MVC 응용 프로그램이 있습니다. 이 응용 프로그램은 권한이없는 모든 사용자를 ADFS로 리디렉션합니다. 로그인에 성공하면 사용자는 소유권 주장이 포함 된 토큰을 사용하여 웹 응용 프로그램으로 다시 리디렉션됩니다. 여기에는 전혀 새로운 것이 없습니다.

지금하고 싶은 일은 발급 된 토큰이있는 WCF 서비스를 호출하여이 서비스가 다시 ADFS로 돌아가서 모든 보안 핸드 쉐이킹을 다시 수행 할 필요가 없도록하려는 것입니다. 시간 나는 마침내 내 서비스 내에서 다음 코드를 사용할 때, 그러나, 서비스를 호출 할 수 있어요 연구의 시간 후

는 내 사용자는 아직 인증되지 않은 :

public string GetName() 
{ 
    var user = Thread.CurrentPrincipal.Identity as ClaimsIdentity; 
    if (user != null && user.IsAuthenticated) 
    { 
     return user.FindFirst(x => x.Type == ClaimTypes.NameIdentifier).Value; 
    } 
    return "Unable to find your username. Something went wrong .... sorry!"; 
} 

내가이 것을 알고있다 주제에는 수백, 수백 건의 기사 및 기타 stackoverflow 관련 질문이 있지만 성공적으로 내 서비스를 호출 할 수 있다고하더라도 내 사용자가 인증되지 않은 이유를 찾지 못했습니다.

일부 다른 코드 및 구성 세부 사항은 당신이 도움이해야 할 수 있습니다

웹 응용 프로그램

서비스 호출

var binding = new WS2007FederationHttpBinding(WSFederationHttpSecurityMode.TransportWithMessageCredential); 
binding.Security.Message.IssuedKeyType = SecurityKeyType.BearerKey; 
binding.Security.Message.EstablishSecurityContext = true; 
binding.Security.Message.IssuerAddress = new EndpointAddress("https://fs.server.com/adfs/services/trust"); 

var endpoint = new EndpointAddress("https://" + "localhost/service" + "/user.svc"); 

var factory = new ChannelFactory<IUser>(binding, endpoint); 
factory.Credentials.SupportInteractive = false; 
factory.Credentials.UseIdentityConfiguration = true; 

var context = (BootstrapContext)((ClaimsIdentity)Thread.CurrentPrincipal.Identity).BootstrapContext; 
var channel = factory.CreateChannelWithIssuedToken(context.SecurityToken, endpoint); 

ViewBag.Username = channel.GetName(); 
((IServiceChannel)channel).Close(); 

return View(); 

의 Web.config

<configuration> 
    <configSections> 
    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 --> 
    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=5.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" /> 
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> 
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> 
    </configSections> 
    <appSettings> 
    <add key="webpages:Version" value="2.0.0.0" /> 
    <add key="webpages:Enabled" value="false" /> 
    <add key="PreserveLoginUrl" value="true" /> 
    <add key="ClientValidationEnabled" value="true" /> 
    <add key="UnobtrusiveJavaScriptEnabled" value="true" /> 
    <add key="ida:FederationMetadataLocation" value="https://fs.server.com:49160/FederationMetadata/2007-06/FederationMetadata.xml" /> 
    <add key="ida:Issuer" value="https://fs.server.com:49160/adfs/ls/" /> 
    <add key="ida:ProviderSelection" value="productionSTS" /> 
    </appSettings> 
    <system.identityModel> 
    <identityConfiguration saveBootstrapContext="true"> 
     <audienceUris> 
     <add value="https://localhost/rp_poc" /> 
     </audienceUris> 
     <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"> 
     <authority name="https://fs.server.com/adfs/services/trust"> 
      <keys> 
      <add thumbprint="723C3A29732FC61F3BE96487E8560F749D1D8256" /> 
      </keys> 
      <validIssuers> 
      <add name="http://fs.server.com/adfs/services/trust" /> 
      </validIssuers> 
     </authority> 
     </issuerNameRegistry> 
    </identityConfiguration> 
    </system.identityModel> 
    <system.identityModel.services> 
    <federationConfiguration> 
     <cookieHandler requireSsl="true" /> 
     <wsFederation passiveRedirectEnabled="true" issuer="https://fs.server.com:49160/adfs/ls/" realm="https://localhost/rp_poc" requireHttps="true" /> 
    </federationConfiguration> 
    </system.identityModel.services> 
    <system.web> 
    <authentication mode="None" /> 
    <compilation debug="true" targetFramework="4.5" /> 
    <httpRuntime targetFramework="4.5" requestValidationMode="4.5" /> 
    <pages> 
     <namespaces> 
     <add namespace="System.Web.Helpers" /> 
     <add namespace="System.Web.Mvc" /> 
     <add namespace="System.Web.Mvc.Ajax" /> 
     <add namespace="System.Web.Mvc.Html" /> 
     <add namespace="System.Web.Optimization" /> 
     <add namespace="System.Web.Routing" /> 
     <add namespace="System.Web.WebPages" /> 
     </namespaces> 
    </pages> 
    </system.web> 
    <system.webServer> 
    <validation validateIntegratedModeConfiguration="false" /> 
    <handlers> 
     <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" /> 
     <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" /> 
     <remove name="ExtensionlessUrlHandler-Integrated-4.0" /> 
     <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" /> 
     <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" /> 
     <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" /> 
    </handlers> 
    <modules> 
     <remove name="FormsAuthentication" /> 
     <add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" /> 
     <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" /> 
    </modules> 
    </system.webServer> 
    <runtime> 
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"> 
     <dependentAssembly> 
     <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" /> 
     <bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="2.0.0.0" /> 
     </dependentAssembly> 
     <dependentAssembly> 
     <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" /> 
     <bindingRedirect oldVersion="1.0.0.0-4.0.0.0" newVersion="4.0.0.0" /> 
     </dependentAssembly> 
     <dependentAssembly> 
     <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" /> 
     <bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="2.0.0.0" /> 
     </dependentAssembly> 
     <dependentAssembly> 
     <assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" /> 
     <bindingRedirect oldVersion="1.0.0.0-1.3.0.0" newVersion="1.3.0.0" /> 
     </dependentAssembly> 
    </assemblyBinding> 
    </runtime> 
</configuration> 

WCF Ser 당신의 WCF 서비스에 serviceAuthorization 동작을 추가하는 그

의 Web.config

<configuration> 
    <configSections> 
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /> 
    </configSections> 
    <system.identityModel> 
    <identityConfiguration saveBootstrapContext="true"> 
     <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"> 
     <authority name="https://fs.server.com/adfs/services/trust"> 
      <keys> 
      <add thumbprint="723C3A29732FC61F3BE96487E8560F749D1D8256" /> 
      </keys> 
      <validIssuers> 
      <add name="http://fs.server.com/adfs/services/trust" /> 
      </validIssuers> 
     </authority> 
     </issuerNameRegistry> 
     <audienceUris> 
     <add value="https://localhost/rp_poc" /> 
     </audienceUris> 
    </identityConfiguration> 
    </system.identityModel> 
    <system.serviceModel> 
    <bindings> 
     <ws2007FederationHttpBinding> 
     <binding> 
      <security mode ="TransportWithMessageCredential"> 
      <message issuedKeyType ="BearerKey" establishSecurityContext="true"> 
       <issuer address ="https://fs.server.com/adfs/services/trust" 
         binding ="ws2007HttpBinding" /> 
      </message> 
      </security> 
     </binding> 
     </ws2007FederationHttpBinding> 
    </bindings> 
    <behaviors> 
     <serviceBehaviors> 
     <behavior name="DefaultBehaviour" > 
      <serviceSecurityAudit auditLogLocation="Application" serviceAuthorizationAuditLevel="Failure" messageAuthenticationAuditLevel="Failure" suppressAuditFailure="true" /> 
      <serviceMetadata httpGetEnabled="true" /> 
      <serviceCredentials useIdentityConfiguration="true"> 
      <serviceCertificate findValue="74 0A FE 19 E9 F0 53 9C 46 D9 F2 D6 56 A7 0C E8" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySerialNumber"> 
      </serviceCertificate> 
      </serviceCredentials> 
     </behavior> 
     </serviceBehaviors> 
    </behaviors> 
    <services> 
     <service name="POC.Security.ServiceClient.User" behaviorConfiguration="DefaultBehaviour" > 
     <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" /> 
     <endpoint contract="POC.Security.ServiceClient.IUser" binding="ws2007FederationHttpBinding" address=""/> 
     </service> 
    </services> 
    <diagnostics> 
     <messageLogging maxMessagesToLog="25000" logEntireMessage="true" 
         logMessagesAtServiceLevel="false" 
         logMalformedMessages="true" logMessagesAtTransportLevel="true"> 
     <filters> 
      <clear/> 
     </filters> 
     </messageLogging> 
    </diagnostics> 
    </system.serviceModel> 
    <system.diagnostics> 
    <sources> 
     <source name="System.ServiceModel" 
      switchValue="Error, Warning, ActivityTracing" propagateActivity="true" > 
     <listeners> 
      <add name="xml" /> 
     </listeners> 
     </source> 
     <source name="System.ServiceModel.MessageLogging" switchValue="Error, Warning"> 
     <listeners> 
      <add name="xml" /> 
     </listeners> 
     </source> 
    </sources> 
    <sharedListeners> 
     <add name="xml" type="System.Diagnostics.XmlWriterTraceListener" initializeData="C:\Temp\ServicesLog.svclog" /> 
    </sharedListeners> 
    </system.diagnostics> 
</configuration> 

Answer 1

시도 - principalPermissionMode = 항상로.

- 동작을 "기본값"으로 설정하려는 경우 일반적으로 이름 특성을 제거합니다. 그렇지 않으면 명시 적으로 서비스 요소에서이를 참조해야합니다.

는 http://leastprivilege.com/2012/11/16/wcf-and-identity-in-net-4-5-external-authentication-with-ws-trust/