iis-7 - 是否可以在没有 LoadUserProfile = True 的情况下运行 WIF

Question

我正在尝试在共享主机上运行 WIF 依赖方应用程序。他们不会将 IIS Setting LoadUserProfile 设置为 true，因此我收到以下错误:

Message: The data protection operation was unsuccessful. This may have been caused by not having the user profile loaded for the current thread's user context, which may be the case when the thread is impersonating. ExceptionStackTrace: at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope) at Microsoft.IdentityModel.Web.ProtectedDataCookieTransform.Encode(Byte[] value)

反正有这个吗？

Answer 1

是的，这是因为您使用的是依赖 DPAPI 的默认 token 加密。您可以将其替换为基于证书的加密。看这里:http://msdn.microsoft.com/en-us/library/ff803371.aspx (滚动到“对应用程序进行了进一步更改...”)

代码是:

void OnServiceConfigurationCreated(object sender, ServiceConfigurationCreatedEventArgs e)
{
    var sessionTransforms =
        new List<CookieTransform>(
            new CookieTransform[] 
            {
                new DeflateCookieTransform(), 
                new RsaEncryptionCookieTransform(
                    e.ServiceConfiguration.ServiceCertificate),
                new RsaSignatureCookieTransform(
                    e.ServiceConfiguration.ServiceCertificate)  
            });
    var readOnlyTransforms = sessionTransforms.AsReadOnly();
    var sessionHandler = new SessionSecurityTokenHandler(readOnlyTransforms);

    e.ServiceConfiguration.SecurityTokenHandlers.AddOrReplace(sessionHandler);
}

和

void Application_Start(object sender, EventArgs e)
{
    FederatedAuthentication.ServiceConfigurationCreated += OnServiceConfigurationCreated;
}

都在 global.asax.cs

顺便说一句，这也是配置 WIF 的“网络农场友好”方式，因此它与机器(实例)无关。 Windows Azure 部署本质上是 Web 场，这就是您在该章节中看到它的原因。

更新 :在较新版本中，API 已更改。更新后的代码如下所示

void OnFederationConfigurationCreated(object sender, FederationConfigurationCreatedEventArgs e)
{
    var sessionTransforms = new List<CookieTransform>(
        new CookieTransform[]
            {
                new DeflateCookieTransform(),
                new RsaEncryptionCookieTransform(e.FederationConfiguration.ServiceCertificate),
                new RsaSignatureCookieTransform(e.FederationConfiguration.ServiceCertificate)
            });
    var sessionHandler = new SessionSecurityTokenHandler(sessionTransforms.AsReadOnly());

    e.FederationConfiguration
        .IdentityConfiguration
        .SecurityTokenHandlers
        .AddOrReplace(sessionHandler);
}

和

protected void Application_Start()
{
    FederatedAuthentication.FederationConfigurationCreated += OnFederationConfigurationCreated;
}