c# - 在 ASP.NET 应用程序上以编程方式配置 Microsoft.IdentityModel 不起作用 - 被动重定向已启用但从未起作用

Question

我正在开发基于声明的身份验证应用程序，并希望将 Microsoft.IdentityModel 配置从 web.config 文件移动到我的代码中以动态管理配置。

这是 web.config 中包含的 federatedAuthentication 部分:

<federatedAuthentication>
    <wsFederation passiveRedirectEnabled="true" issuer="trust" realm="real" requireHttps="false" />
    <cookieHandler requireSsl="true" />
</federatedAuthentication>

我尝试在 Application_Start() 方法中附加一个 EventHandler 来实现代码中的配置而不是 web.config 文件:

    protected void Application_Start()
    {
        FederatedAuthentication.ServiceConfigurationCreated += new EventHandler<ServiceConfigurationCreatedEventArgs>(FederatedAuthentication_ServiceConfigurationCreated);
    }

    private static void FederatedAuthentication_ServiceConfigurationCreated(Object sender, ServiceConfigurationCreatedEventArgs e)
    {
        const string rpRealm = "realm";
        const bool requireSsl = false;
        const bool requireHttps = false;
        const bool passRedirect = true;
        const string issuer = "trust";

        ...

        FederatedAuthentication.WSFederationAuthenticationModule.PassiveRedirectEnabled = passRedirect;
        FederatedAuthentication.WSFederationAuthenticationModule.Issuer = issuer;
        FederatedAuthentication.WSFederationAuthenticationModule.Realm = rpRealm;
        FederatedAuthentication.WSFederationAuthenticationModule.RequireHttps = requireHttps;

        ...
    }

当我删除 web.config 文件中的配置并构建代码时，出现了应用程序没有重定向到 Issuer url 的问题，即使 PassiveRedirectEnabled 属性已设置为 true。

通过放置断点，我确认上面的代码确实运行并且没有产生异常；然而，被动重定向从未奏效。

附言我使用的是 WIF 3.5；导入的程序集是 Microsoft.IdentityModel.dll

Answer 1

感谢@jonho 的帮助!但是，您的代码在 WIF 4.5 中工作，而我在 WIF 3.5 中工作，这里的情况有点不同...

在 Internet 上四处搜索并使用我的代码进行测试后，在 http://social.msdn.microsoft.com/forums/vstudio/en-US/41b9a137-faca-43c6-b965-01d5322df5f0/change-microsoftidentitymodel-configuration 的帮助下，我想出了一个可行的解决方案.

为了防止人们像我一样被卡住，我是这样做的:

1. 在创建ServiceConfiguration时添加事件处理程序，并在事件处理程序中添加允许的受众和证书信息:

   protected void Application_Start()
   {
       FederatedAuthentication.ServiceConfigurationCreated += 
                   new EventHandler<ServiceConfigurationCreatedEventArgs>(FederatedAuthentication_ServiceConfigurationCreated);
   }
   
   private static void FederatedAuthentication_ServiceConfigurationCreated(Object sender, ServiceConfigurationCreatedEventArgs e)
   {
       const string allowedAudience = "allowed_aud";
       const string certThumbprint = "thumb";
       const string certName = "name";
   
       var serviceConfiguration = new ServiceConfiguration();
   
       serviceConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(allowedAudience));
   
       var issuerNameRegistry = new ConfigurationBasedIssuerNameRegistry();
       issuerNameRegistry.AddTrustedIssuer(certThumbprint, certName);
       serviceConfiguration.IssuerNameRegistry = issuerNameRegistry;
       serviceConfiguration.CertificateValidationMode = X509CertificateValidationMode.None;
   
       e.ServiceConfiguration = serviceConfiguration;
   }
   

2. 为 ASP.NET 应用程序实现 Application_AuthenticateRequest() 方法。在那里提供发行人信息:

   protected void Application_AuthenticateRequest(Object sender, EventArgs e)
   {
       FederatedAuthentication.SessionAuthenticationModule.CookieHandler.RequireSsl = requireSsl;
       FederatedAuthentication.WSFederationAuthenticationModule.Issuer = issuer;
       FederatedAuthentication.WSFederationAuthenticationModule.Realm = rpRealm;
       FederatedAuthentication.WSFederationAuthenticationModule.PassiveRedirectEnabled = passRedirect;
       FederatedAuthentication.WSFederationAuthenticationModule.RequireHttps = requireHttps;
   }
   

这应该足以使被动重定向与 WIF 3.5 中的 ASP.NET 应用程序一起工作