asp.net-mvc - ADFS 2.0 Windows 2008 R2 Web API

Question

我想制作一个与Web API应用程序对话的MVC Web应用程序，并使用ADFS 2.0(在Windows 2008 R2上)进行身份验证。

我设法使MVC Web应用程序能够使用ADFS进行身份验证。

问:但是我不知道如何将ADFS 2.0(在Windows 2008 R2上)从MVC Web联合到Web API(假设它们将部署在单独的服务器中)？

我发现了很多有关如何使用WCF或Windows Server 2012 R2进行此操作的文章，但没有找到有关Windows Server 2008 R2中的Web API和ADFS 2.0的文章。

编辑，最后我去了poor man delegation(将我收到的相同 token 传递给前端到后端(因为再次调用adfs没有意义)

前端->调用GetToken并放入授权 header 中(我将其编码为base64)

public string GetToken()
{
    BootstrapContext bootstrapContext = ClaimsPrincipal.Current.Identities.First().BootstrapContext as BootstrapContext;
    string token = bootstrapContext.Token;

    if (string.IsNullOrEmpty(token))
        token = ToTokenXmlString(bootstrapContext.SecurityToken as SamlSecurityToken);

    return token;
}

string ToTokenXmlString(SecurityToken token)
{
    var genericToken = token as GenericXmlSecurityToken;

    if (genericToken != null)
        return genericToken.TokenXml.OuterXml;

    var handler = SecurityTokenHandlerCollection.CreateDefaultSecurityTokenHandlerCollection();
    return ToTokenXmlString(token, handler);
}

string ToTokenXmlString(SecurityToken token, SecurityTokenHandlerCollection handler)
{
    if (!handler.CanWriteToken(token))
        throw new InvalidOperationException("Token type not suppoted");

    var sb = new StringBuilder(128);
    using (StringWriter stringWriter = new StringWriter(sb))
    {
        using (var textWriter = new XmlTextWriter(stringWriter))
        {
            handler.WriteToken(textWriter, token);
            return sb.ToString();
        }
    }
}

后端->解析并验证 token ->

public ClaimsIdentity GetIdentityFromToken(string tokenBase64)
{
    if (string.IsNullOrEmpty(tokenBase64))
        return null;

    byte[] tokenByteArray = Convert.FromBase64String(tokenBase64);
    string decodedToken = Encoding.UTF8.GetString(tokenByteArray);

    if (string.IsNullOrWhiteSpace(decodedToken))
        return null;
    try
    {
        var handlers = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.SecurityTokenHandlers;
        SecurityToken token;
        using (StringReader stringReader = new StringReader(decodedToken))
        {
            using (XmlTextReader xmlReader = new XmlTextReader(stringReader))
            {
                token = handlers.ReadToken(xmlReader);
            }
        }

        if (token == null)
            return null;

        return handlers.ValidateToken(token).FirstOrDefault();
    }
    catch (Exception e)
    {
        logger.Error(new AuthenticationException("Error validating the token from ADFS", e));

        return null;
    }
}

Answer 1

我通过将从Adfs接收到的承载 token 传递到Web api调用的授权 header 中，然后使用Microsoft.Owin.Security.Jwt nuget程序包在owin启动过程中将 token 转换为httpcontext当前身份来实现此目的。网络API项目。

本示例使用jwt token 作为承载 token 。为您要使用的 token 类型选择适当的NuGet软件包。

在MVC Controller 中构造WebRequest

 BootstrapContext bc = ClaimsPrincipal.Current.Identities.First().BootstrapContext as BootstrapContext;
 HttpWebRequest request = WebRequest.Create(ConfigurationManager.AppSettings["ApiUrl"]) as HttpWebRequest;
 request.Method = "GET";
 request.Headers["Authorization"] = "Bearer " + bc.Token;

Web api 中的Owin Startup.cs文件。app.UseWebApi(con​​fig)行之前。

 app.UseJwtBearerAuthentication(
            new JwtBearerAuthenticationOptions
            {
                AuthenticationMode = AuthenticationMode.Active,
                AllowedAudiences = new[] { ConfigurationSettings.AppSettings["ida:Realm"] },
                IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[] 
                    { 
                        new SymmetricKeyIssuerSecurityTokenProvider(
                            ConfigurationSettings.AppSettings["ida:ValidIssuer"],
                            ConfigurationSettings.AppSettings["ida:SymmetricKey"])
                    },
                Provider = new OAuthBearerAuthenticationProvider
                {
                    OnValidateIdentity = context =>
                    {
                        return System.Threading.Tasks.Task.FromResult<object>(null);
                    }
                }
            });