asp.net-mvc - UseWsFederationAuthentication - AuthenticationException : The remote certificate is invalid according to the validation procedure

Question

每次我尝试通过 VS2015 和 IIS Express 在我的开发盒上运行我的 MVC 项目时，我都会收到一个错误。它使用此代码对我们的 ADFS 服务器进行身份验证。

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseWsFederationAuthentication(
                new WsFederationAuthenticationOptions
                {
                    Wtrealm = realm,
                    MetadataAddress = adfsMetadata
                });

这是我在浏览器中遇到的错误。

[AuthenticationException: The remote certificate is invalid accordingto the validation procedure.]
System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) +231
System.Net.PooledStream.EndWrite(IAsyncResult asyncResult) +15
System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) +119

[WebException: The underlying connection was closed: Could notestablish trust relationship for the SSL/TLS secure channel.]
System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)+606 System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)+64

[HttpRequestException: An error occurred while sending the request.]
System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()+28 Microsoft.IdentityModel.Protocols.d__0.MoveNext()+453

[IOException: Unable to get document from:https://adfs.DOMAIN.com/FederationMetadata/2007-06/FederationMetadata.xml]Microsoft.IdentityModel.Protocols.d__0.MoveNext()+830 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter1.GetResult() +28 Microsoft.IdentityModel.Protocols.<GetAsync>d__1.MoveNext() +606 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +92 System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +58 System.Runtime.CompilerServices.TaskAwaiter1.GetResult()+28 Microsoft.IdentityModel.Protocols.d__3.MoveNext()+1332

[InvalidOperationException: IDX10803: Unable to create to obtainconfiguration from:'https://adfs.DOMAIN.com/FederationMetadata/2007-06/FederationMetadata.xml'.]Microsoft.IdentityModel.Protocols.d__3.MoveNext()+2226 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()+28 Microsoft.Owin.Security.WsFederation.d__c.MoveNext()+772 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Security.Infrastructure.d__b.MoveNext()+447 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Security.Infrastructure.d__8.MoveNext()+440 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Security.Infrastructure.d__5.MoveNext()+266 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Security.Infrastructure.d__0.MoveNext() +1174 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.d__5.MoveNext()+287 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Security.Infrastructure.d__0.MoveNext() +937 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.d__5.MoveNext()+287 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Tasktask) +92
System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Tasktask) +58 System.Runtime.CompilerServices.TaskAwaiter.GetResult()+26 Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.d__2.MoveNext()+272 System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +26 Microsoft.Owin.Host.SystemWeb.Infrastructure.ErrorState.Rethrow() +33Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResultar) +150
Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.EndFinalWork(IAsyncResultar) +42
System.Web.AsyncEventExecutionStep.OnAsyncEventCompletion(IAsyncResultar) +9791593

它正在工作，现在它不再起作用了......为什么？
关于为什么这不起作用的任何想法，为什么根据验证程序(该程序在哪里？)远程证书无效，以及我如何使其备份​​和运行？

Answer 1

再次感谢 Thuan 的回答。

从答案中，我能够思考到底发生了什么(这对于弄清楚事情总是至关重要的)。关键是意识到问题源于远程证书未通过验证检查，而没有其他原因。所以我发现在 UseWsFederationAuthentication 调用中有一个 BackchannelCertificateValidator 选项，可用于验证证书是否有效。然后我找到了这个 post这帮助我想出了验证证书的代码。

该帖子从 Microsoft 站点 ( https://msdn.microsoft.com/en-us/library/office/dd633677(v=exchg.80).aspx ) 中找到了他们的代码。在文章中，它说明了有关代码的内容。

The certificate validation callback method in this example provides sufficient security for development and testing of EWS Managed API applications. However, it may not provide sufficient security for your deployed application. You should always make sure that the certificate validation callback method that you use meets the security requirements of your organization.

所以我必须想办法让它只在 Debug模式下运行。

编码:

public void ConfigureAuth(IAppBuilder app)
        {

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseWsFederationAuthentication(
                new WsFederationAuthenticationOptions
                {

                    BackchannelCertificateValidator = new CertificateValidator(),

                    Wtrealm = realm,
                    MetadataAddress = adfsMetadata
                });
        }

类:

public class CertificateValidator : ICertificateValidator
    {
        public bool Validate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
        {
            // If the certificate is a valid, signed certificate, return true.
            if (sslPolicyErrors == System.Net.Security.SslPolicyErrors.None)
            {
                return true;
            }

            // If there are errors in the certificate chain, look at each error to determine the cause.
            if ((sslPolicyErrors & System.Net.Security.SslPolicyErrors.RemoteCertificateChainErrors) != 0)
            {
                if (chain != null && chain.ChainStatus != null)
                {
                    foreach (System.Security.Cryptography.X509Certificates.X509ChainStatus status in chain.ChainStatus)
                    {
                        if ((certificate.Subject == certificate.Issuer) &&
                           (status.Status == System.Security.Cryptography.X509Certificates.X509ChainStatusFlags.UntrustedRoot))
                        {
                            // Self-signed certificates with an untrusted root are valid. 
                            continue;
                        }
                        else
                        {
                            if (status.Status != System.Security.Cryptography.X509Certificates.X509ChainStatusFlags.NoError)
                            {
                                // If there are any other errors in the certificate chain, the certificate is invalid,
                                // so the method returns false.
                                return false;
                            }
                        }
                    }
                }

                // When processing reaches this line, the only errors in the certificate chain are 
                // untrusted root errors for self-signed certificates. These certificates are valid
                // for default Exchange server installations, so return true.
                return true;
            }
            else
            {
                // In all other cases, return false.
                return false;
            }
        }
    }