asp.net - ADFS 2.0 身份验证的 Web 服务调用

Question

我有一个使用 ADFS 2.0 进行身份验证的 ASP.NET MVC 网络应用程序。一些 MVC Controller 操作充当通用 Web 服务端点，接收和提供 JSON。我想构建一个客户端应用程序来自动执行应用程序的某些功能。为此，我正在构建一个 API 访问库，它将向 Web 服务发出 HTTP 请求以完成其工作。

我一直在尝试进行身份验证。我正在为 ADFS 2.0 使用表单例份验证，所以我不应该能够简单地使用有效的用户名和密码模拟表单发布以生成 token 吗？我没有收到返回的 token ，而是获得了登录页面。我不确定我还需要做什么来验证我的请求。我的代码粘贴在下面......但也许我做的完全错了，还有一些我不知道的事情？

string postData = string.Empty;
postData += "ctl00$ContentPlaceHolder1$UsernameTextBox=" + username + "&";
postData += "ctl00$ContentPlaceHolder1$PasswordTextBox=" + password;
postData += "&AuthMethod=FormsAuthentication";// Submit the data back

string url = "{url of website}";
HttpWebRequest getTokenRequest = WebRequest.Create(url) as HttpWebRequest;

getTokenRequest.CookieContainer = cookies;
getTokenRequest.ContentType = "application/x-www-form-urlencoded";
getTokenRequest.ContentLength = postData.Length;
getTokenRequest.Method = "POST";

// post the data to the request
using (StreamWriter sw = new StreamWriter(getTokenRequest.GetRequestStream()))
{
    sw.Write(postData);
    sw.Flush();
    sw.Close();
}

HttpWebResponse getTokenResponse = (HttpWebResponse)getTokenRequest.GetResponse(); 

string responseString = ResponseToString(getTokenResponse);

我也试过另一种方法，也行不通。这使用 WCF。我收到错误:

Secure channel cannot be opened because security negotiation with the remote endpoint has failed.This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint.

        const string relyingPartyId = "[ID]"; //ID of the relying party in AD FS
        const string adfsEndpoint = "https://[server]/adfs/services/trust/13/usernamemixed"; //url to hit - username & pw?
        const string certSubject = "[subject]"; //?

        //Setup the connection to ADFS
        var factory = new Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannelFactory(
            new WindowsWSTrustBinding(SecurityMode.TransportWithMessageCredential), 
            new EndpointAddress(adfsEndpoint));

        factory.TrustVersion = TrustVersion.WSTrust13;

        factory.Credentials.UserName.UserName = "[un]";
        factory.Credentials.UserName.Password = "[pw]";

        //Setup the request object 
        var rst = new Microsoft.IdentityModel.Protocols.WSTrust.RequestSecurityToken
        {
            RequestType = Microsoft.IdentityModel.SecurityTokenService.RequestTypes.Issue,
            KeyType = Microsoft.IdentityModel.SecurityTokenService.KeyTypes.Bearer,
            AppliesTo = new EndpointAddress(relyingPartyId)
        };

        //Open a connection to ADFS and get a token for the logged in user
        var channel = factory.CreateChannel();

        //added to solve a trust certificate issue - bad from a security perspective
        System.Net.ServicePointManager.ServerCertificateValidationCallback +=
        (se, cert, chain, sslerror) =>
        {
            return true;
        };

        var genericToken = channel.Issue(rst) as GenericXmlSecurityToken;

Answer 1

问题很可能出在:string url = "{url of website}";。和/或 POST 中缺少参数。

它不应该只是任何 URL。它应该是格式正确的 WS-Federation 请求。使用时间戳等。通常/有时(在当前的 ADFS 中)这是一个两步过程。首先是正常请求，然后是真正的(uid+pwd)认证。两者都在适当的位置使用适当的 WS-Fed 参数。只有 uid 和 pwd 是不够的。

现在是明显的答复，没有侮辱的意思:我建议您跟踪常规登录过程，然后将这些确切的 HTTP 请求与您的请求进行比较。