c# - Identity Server 3 作为 SharePoint 2013/2016 的 Ws-Fed 身份提供者

Question

我正在尝试使用 SharePoint 2016 设置 [Thinktecture] Identity Server 3。但是，在用户通过身份验证后，我遇到了 SharePoint 和 Identity Server 3 之间的无限循环。 IdServer 日志中没有错误。如果有人能查看我下面的步骤，我将不胜感激。

身份服务器 3 配置

我从 Self-Host with WS-Federation sample 开始, 并修改以添加新的依赖方。 Identity Server 本身运行在与 SharePoint 完全独立的服务器上，跨 Internet，使用公共(public) DNS 注册主机名:

const string url = "https://mydevserver.example.com:44333/core";
using (WebApp.Start<Startup>(url))
{
    Console.WriteLine("\n\nServer listening at {0}. Press enter to stop", url);
    Console.ReadLine();
}

依赖方

new RelyingParty
{
    Name = "SharePoint 2016 Trial",
    Realm = "urn:idserver:sp16trial",
    Enabled = true,
    ReplyUrl = "https://mysharepointserver.example.com/_trust/",
    TokenType = TokenTypes.Saml11TokenProfile11,
    TokenLifeTime = 1,

    ClaimMappings = new Dictionary<string, string>
    {
        { "email", ClaimTypes.Email },
        { "sub", ClaimTypes.NameIdentifier },
        { "name", ClaimTypes.Name },
        { "given_name", ClaimTypes.GivenName },
        { "surname", ClaimTypes.Surname }
   }
}

SharePoint 配置

元数据和证书

我导航到 https://mydevserver.example.com:44333/core/wsfed/metadata并将其保存为 XML 文件，我将其暂时放在 SharePoint 服务器上。从 XML 文件中，我提取公共(public) X509 证书并将其保存为 temp.cer文件与下面的 Powershell 脚本位于同一文件夹中。

Powershell 脚本

$realm = "urn:idserver:sp16trial"
$signinurl = "https://mydevserver.example.com:44333/core/wsfed"
$description ="My Test Identity Server 3"

[xml]$fedmdXml = Get-Content metadata.xml
$cert = Get-PfxCertificate -FilePath temp.cer

asnp *sh*
$name = "IdSrv"
New-SPTrustedRootAuthority -Name $name -Certificate $cert | Out-Null

$map1 = New-SPClaimTypeMapping "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Email" –SameAsIncoming 
$map2 = New-SPClaimTypeMapping "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming
New-SPTrustedIdentityTokenIssuer -Name $name -Description $description -Realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map1,$map2 -SignInUrl $signinurl -IdentifierClaim $map1.InputClaimType

我导航到 SharePoint 中央管理 并将新的可信提供程序 连接到 Web 应用程序。

在 Sharepoint 中央管理中，我通过 Sharepoint 用户政策 授权用户“bobsmith@example.com”。

我导航到 https://mysharepointserver.example.com我被重定向到登录页面 https://mydevserver.example.com:44333/core/login?signin=<guidhere>正如预期的那样。

我以用户身份登录 bob ，但随后在 SharePoint 和 Identity Server 之间触发了无限循环。这是来自 IdSvr 日志:

日志

Server listening at https://mydevserver.example.com:44333/core. Press enter to stop
02/26/2017 22:29:53 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 Start WS-Federation request
02/26/2017 22:29:53 -08:00 [DBG] (IdentityServer3.WsFederation.WsFederationController)
 AbsoluteUri: [https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn%3aidserver%3asp16trial&wctx=https%3a%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]
02/26/2017 22:29:53 -08:00 [DBG] (IdentityServer3.WsFederation.WsFederationController)
 PublicUri: [https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn:idserver:sp16trial&wctx=https:%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]
02/26/2017 22:29:53 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 WsFederation signin request
02/26/2017 22:29:53 -08:00 [INF] (IdentityServer3.WsFederation.Validation.SignInValidator)
 Start WS-Federation signin request validation
02/26/2017 22:29:53 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 Redirecting to login page
02/26/2017 22:29:53 -08:00 [DBG] (IdentityServer3.Core.Configuration.Hosting.MessageCookie`1)
 Protecting message: {"ReturnUrl":"https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn%3aidserver%3asp16trial&wctx=https%3a%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fS
ource%3d%252F","AcrValues":[],"Created":636237737932988392}
02/26/2017 22:29:53 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 Login page requested
02/26/2017 22:29:53 -08:00 [DBG] (IdentityServer3.Core.Endpoints.AuthenticationController)
 signin message passed to login: {
  "ReturnUrl": "https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn%3aidserver%3asp16trial&wctx=https%3a%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F",
  "ClientId": null,
  "IdP": null,
  "Tenant": null,
  "LoginHint": null,
  "DisplayMode": null,
  "UiLocales": null,
  "AcrValues": [],
  "Created": 636237737932988392
}
02/26/2017 22:29:53 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 rendering login page
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 Login page submitted
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 Login credentials successfully validated by user service
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 Calling PostAuthenticateAsync on the user service
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 issuing primary signin cookie
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.Core.Endpoints.AuthenticationController)
 redirecting to: https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn:idserver:sp16trial&wctx=https:%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 Start WS-Federation request
02/26/2017 22:30:01 -08:00 [DBG] (IdentityServer3.WsFederation.WsFederationController)
 AbsoluteUri: [https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn%3aidserver%3asp16trial&wctx=https%3a%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]
02/26/2017 22:30:01 -08:00 [DBG] (IdentityServer3.WsFederation.WsFederationController)
 PublicUri: [https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn:idserver:sp16trial&wctx=https:%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 WsFederation signin request
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.WsFederation.Validation.SignInValidator)
 Start WS-Federation signin request validation
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.WsFederation.Validation.SignInValidator)
 End WS-Federation signin request validation
{
  "Realm": "urn:idserver:sp16trial",
  "RelyingPartyName": "SharePoint 2016 Trial",
  "ReplyUrl": "https://mysharepointserver.example.com/_trust/"
}
02/26/2017 22:30:01 -08:00 [INF] (IdentityServer3.WsFederation.ResponseHandling.SignInResponseGenerator)
 Creating WS-Federation signin response
02/26/2017 22:30:01 -08:00 [DBG] (IdentityServer3.WsFederation.Hosting.CookieMiddlewareTrackingCookieService)
 Retrieving values of cookie IdSvr.WsFedTracking
02/26/2017 22:30:01 -08:00 [DBG] (IdentityServer3.WsFederation.Hosting.CookieMiddlewareTrackingCookieService)
 Cookie IdSvr.WsFedTracking does not exist
02/26/2017 22:30:01 -08:00 [DBG] (IdentityServer3.WsFederation.Hosting.CookieMiddlewareTrackingCookieService)
 Adding https://mysharepointserver.example.com/_trust/ to IdSvr.WsFedTracking cookie
02/26/2017 22:30:01 -08:00 [DBG] (IdentityServer3.WsFederation.Results.SignInResult)
 Returning WS-Federation signin response
02/26/2017 22:30:02 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 Start WS-Federation request
02/26/2017 22:30:02 -08:00 [DBG] (IdentityServer3.WsFederation.WsFederationController)
 AbsoluteUri: [https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn%3aidserver%3asp16trial&wctx=https%3a%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]
02/26/2017 22:30:02 -08:00 [DBG] (IdentityServer3.WsFederation.WsFederationController)
 PublicUri: [https://mydevserver.example.com:44333/core/wsfed?wa=wsignin1.0&wtrealm=urn:idserver:sp16trial&wctx=https:%2f%2fmysharepointserver.example.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]
02/26/2017 22:30:02 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 WsFederation signin request
02/26/2017 22:30:02 -08:00 [INF] (IdentityServer3.WsFederation.Validation.SignInValidator)
 Start WS-Federation signin request validation
02/26/2017 22:30:02 -08:00 [INF] (IdentityServer3.WsFederation.Validation.SignInValidator)
 End WS-Federation signin request validation
{
  "Realm": "urn:idserver:sp16trial",
  "RelyingPartyName": "SharePoint 2016 Trial",
  "ReplyUrl": "https://mysharepointserver.example.com/_trust/"
}
02/26/2017 22:30:02 -08:00 [INF] (IdentityServer3.WsFederation.ResponseHandling.SignInResponseGenerator)
 Creating WS-Federation signin response
02/26/2017 22:30:02 -08:00 [DBG] (IdentityServer3.WsFederation.Hosting.CookieMiddlewareTrackingCookieService)
 Retrieving values of cookie IdSvr.WsFedTracking
02/26/2017 22:30:02 -08:00 [DBG] (IdentityServer3.WsFederation.Hosting.CookieMiddlewareTrackingCookieService)
 https://mysharepointserver.example.com/_trust/ already exists in IdSvr.WsFedTracking cookie
02/26/2017 22:30:02 -08:00 [DBG] (IdentityServer3.WsFederation.Results.SignInResult)
 Returning WS-Federation signin response
02/26/2017 22:30:03 -08:00 [INF] (IdentityServer3.WsFederation.WsFederationController)
 Start WS-Federation request

知道我错过了什么吗？

Answer 1

您正面临无限重定向，因为您将依赖方的 ReplyUrl 设置为信任页面，而这是不正确的。

ReplyUrl应该是登录成功后身份服务器重定向到的URL。

这应该是您的依赖方的正确逻辑:

ReplyUrl = "https://mysharepointserver.example.com/"

您需要在客户端类中设置信任 URL:

RedirectUris = { "https://mysharepointserver.example.com/_trust/" },