asp.net-mvc - 身份不是使用 WIF 的 IClaimsIdentity(在 ASP.NET MVC 4/Azure 上)

Question

我有 VS2012RC 的 WIF 工具，我正在尝试让我的 ASP.NET MVC 4 项目使用它们。我已经安装了NuGet package对于 Microsoft.IdentityModel.dll。

MVC 项目是 Azure 项目的一部分，但我现在选择了 MVC 项目来启动。

目前，我选择了“本地开发测试STS”(使用默认设置)。当我执行以下代码时(在我的 HomeController Index View 中):

<p>Authenticated: @User.Identity.IsAuthenticated</p>
<p>Name: @User.Identity.Name</p>
@{
    var identity = User.Identity as Microsoft.IdentityModel.Claims.IClaimsIdentity;
    if (identity == null)
    {
        <p>Error: no identity claims to process!</p>
    }
    else
    {
        <table>
            <tr>
                <th>Type</th><th>Value</th><th>Issuer</th><th>Original Issuer</th>
            </tr>
            @foreach (var claim in identity.Claims)
            {
                <tr>
                    <td>@claim.ClaimType</td><td>@claim.Value</td><td>@claim.Issuer</td><td>@claim.OriginalIssuer</td>
                </tr>
            }
        </table>
    }
}

然后我得到这样的输出:

<p>Authenticated: True</p>
<p>Name: Terry</p>
<p>Error: no identity claims to process!</p>

为什么 claim 没有被受理？

以下是 web.config 的相关部分:

<configSections>
  <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
</configSections>
<appSettings>
  <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  <add key="webpages:Version" value="2.0.0.0" />
  <add key="webpages:Enabled" value="false" />
  <add key="PreserveLoginUrl" value="true" />
  <add key="ida:FederationMetadataLocation" value="http://localhost:13340/wsFederationSTS/FederationMetadata/2007-06/FederationMetadata.xml" />
  <add key="ida:ProviderSelection" value="localSTS" />
</appSettings>
<location path="FederationMetadata">
  <system.web>
    <authorization>
      <allow users="*" />
    </authorization>
  </system.web>
</location>
<system.web>
  <authorization>
    <deny users="?" />
  </authorization>
  <authentication mode="None" />
  <profile defaultProvider="DefaultProfileProvider">
    <providers>
      <add name="DefaultProfileProvider" type="System.Web.Providers.DefaultProfileProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" applicationName="/" />
    </providers>
  </profile>
  <membership defaultProvider="DefaultMembershipProvider">
    <providers>
      <add name="DefaultMembershipProvider" type="System.Web.Providers.DefaultMembershipProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/" />
    </providers>
  </membership>
  <roleManager defaultProvider="DefaultRoleProvider">
    <providers>
      <add name="DefaultRoleProvider" type="System.Web.Providers.DefaultRoleProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" applicationName="/" />
    </providers>
  </roleManager>
  <sessionState mode="InProc" customProvider="DefaultSessionProvider">
    <providers>
      <add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" />
    </providers>
  </sessionState>
</system.web>
<system.webServer>
  <validation validateIntegratedModeConfiguration="false" />
  <modules runAllManagedModulesForAllRequests="true">
    <add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
    <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
  </modules>
</system.webServer>
<system.identityModel>
  <identityConfiguration>
    <audienceUris>
      <add value="http://localhost:50332/" />
    </audienceUris>
    <issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
      <trustedIssuers>
        <add thumbprint="9B74CB2F320F7AAFC156E1252270B1DC01EF40D0" name="LocalSTS" />
        <add thumbprint="C00C014CA49559426B6D70162C2D89689E9397FF" name="https://nitoprograms-0.accesscontrol.windows.net/" />
      </trustedIssuers>
    </issuerNameRegistry>
    <certificateValidation certificateValidationMode="None" />
  </identityConfiguration>
</system.identityModel>
<system.identityModel.services>
  <federationConfiguration>
    <cookieHandler requireSsl="false" />
    <wsFederation passiveRedirectEnabled="true" issuer="http://localhost:13340/wsFederationSTS/Issue" realm="http://localhost:50332/" reply="http://localhost:50332/" requireHttps="false" />
  </federationConfiguration>
</system.identityModel.services>

Answer 1

在本地运行时(在 Windows 8 Release Preview 计算机上)，以下代码确实工作:

<p>Authenticated: @User.Identity.IsAuthenticated</p>
<p>Name: @User.Identity.Name</p>
@{
    dynamic identity = User.Identity;
    <table>
        <tr>
            <th>Type</th><th>Value</th><th>Issuer</th><th>Original Issuer</th>
        </tr>
        @foreach (var claim in identity.Claims)
        {
            <tr>
                <td>@claim.Type</td><td>@claim.Value</td><td>@claim.Issuer</td><td>@claim.OriginalIssuer</td>
            </tr>
        }
    </table>
}

这让我相信 VS2012RC 的 WIF 工具仅支持 .NET 4.5 作为目标。

本地运行时，实际运行时是 .NET 4.5，它具有与 WIF 相关的核心标识更改(比较 this diagram for .NET 4.0 与 this diagram for .NET 4.5 )。因此，通过使用dynamic(并将ClaimType更改为Type)，我能够在本地访问.NET 4.5 WIF运行时(即使该项目的目标是.NET 4.0)。

我尝试部署到云，但应用程序提示找不到 System.IdentityModel.Services.dll(因为 Azure 目前仅使用 .NET 4.0)。对我来说这没什么大不了的，因为我不打算在 .NET 4.5 发布之前进行部署。