wcf - Azure Active Directory 和 WCF 身份验证

Question

我有 WCF 服务，我需要使用 Azure Active Directory 来保护它。我已经阅读了此处和 Social.msdn 上的所有相关问题，但仍然无法让我的示例正常工作。我希望身份验证以以下方式工作。

1. 当用户从客户端调用 WCF 服务时，不会显示任何弹出窗口。
2. 用户传递用户名/密码并从 Azure ADFS 接收身份验证 token
3. 然后在应用程序中(暂时设为控制台应用程序)，我们通过 Create CreateChannelWithIssuedToken 方法打开 channel ，所有后续调用均使用从 AAD 获取的 token 进行。

我在做什么以及我的问题是什么。我现在使用 VS 2012 和身份和访问工具为 WCF 服务生成正确的配置文件。所以我的服务有以下地址。 http://localhost:1785/Service1.svc

我转到 Azure 门户并创建名为 http://localhost:1785/Service1.svc 的新 Web 应用程序，登录 URL http://localhost:1785/Service1。 svc 和应用程序 ID url http://localhost:1785/Service1.svc

然后我检查应用程序的端点并复制联合元数据，如下所示https://login.windows.net/{some guid}/federationmetadata/2007-06/federationmetadata.xml

使用身份和访问工具，我将 WAAD 身份提供程序添加到服务项目中。我的 web.config 文件如下所示:

<?xml version="1.0"?>
<configuration>
  <configSections>
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  </configSections>
  <appSettings>
    <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
    <add key="ida:FederationMetadataLocation" value="https://login.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/federationmetadata/2007-06/federationmetadata.xml" />
    <add key="ida:ProviderSelection" value="productionSTS" />
  </appSettings>
  <location path="FederationMetadata">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" />
  </system.web>
  <system.serviceModel>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false" />
          <serviceCredentials useIdentityConfiguration="true">
            <!--Certificate added by Identity and Access Tool for Visual Studio.-->
            <serviceCertificate findValue="CN=localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <protocolMapping>
      <add scheme="http" binding="ws2007FederationHttpBinding" />
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
    <bindings>
      <ws2007FederationHttpBinding>
        <binding name="">
          <security mode="Message">
            <message>
              <issuerMetadata address="https://login.windows.net/adfs/services/trust/mex" />
            </message>
          </security>
        </binding>
      </ws2007FederationHttpBinding>
    </bindings>
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
    <!--
        To browse web app root directory during debugging, set the value below to true.
        Set to false before deployment to avoid disclosing web app folder information.
      -->
    <directoryBrowse enabled="true" />
  </system.webServer>
  <system.identityModel>
    <identityConfiguration>
      <audienceUris>
        <add value="http://localhost:1785/Service1.svc" />
      </audienceUris>
      <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
        <authority name="https://sts.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/">
          <keys>
            <add thumbprint="92B88C3DD981BF1EBCB244FCFA63C007706C79E0" />
            <add thumbprint="3270BF5597004DF339A4E62224731B6BD82810A6" />
          </keys>
          <validIssuers>
            <add name="https://sts.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/" />
          </validIssuers>
        </authority>
      </issuerNameRegistry>
      <!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
      <certificateValidation certificateValidationMode="None" />
    </identityConfiguration>
  </system.identityModel>
</configuration>

然后我创建了控制台应用程序并向服务项目添加了服务引用。添加引用后，配置如下所示

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <startup> 
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
    </startup>
    <system.serviceModel>
        <bindings>
            <ws2007FederationHttpBinding>
                <binding name="WS2007FederationHttpBinding_IService1">
                    <security>
                        <message>
                            <!--<issuer address="http://schemas.microsoft.com/2005/12/ServiceModel/Addressing/Anonymous" />-->
                          <issuer address="https://login.windows.net/34bb8966-5537-4b1b-85ed-f501a06c1225/wsfed" binding="ws2007HttpBinding"/>
                          <issuerMetadata address="https://login.windows.net/adfs/services/trust/mex" />
                            <tokenRequestParameters>
                                <trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                                    <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType>
                                    <trust:KeySize xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">256</trust:KeySize>
                                    <trust:KeyWrapAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</trust:KeyWrapAlgorithm>
                                    <trust:EncryptWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptWith>
                                    <trust:SignWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2000/09/xmldsig#hmac-sha1</trust:SignWith>
                                    <trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/10/xml-exc-c14n#</trust:CanonicalizationAlgorithm>
                                    <trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
                                </trust:SecondaryParameters>
                            </tokenRequestParameters>
                        </message>
                    </security>
                </binding>
            </ws2007FederationHttpBinding>
            <ws2007HttpBinding>
                <binding name="">
                    <security mode="TransportWithMessageCredential">
                        <transport clientCredentialType="InheritedFromHost" />
                        <message establishSecurityContext="false" />
                    </security>
                </binding>
            </ws2007HttpBinding>
        </bindings>
        <client>
            <endpoint address="http://localhost:1785/Service1.svc" binding="ws2007FederationHttpBinding"
                bindingConfiguration="WS2007FederationHttpBinding_IService1"
                contract="SomeService.IService1" name="WS2007FederationHttpBinding_IService1">
                <identity>
                    <certificate encodedValue="AwAAAAEAAAAUAAAACLf4gntwdBYHCTmyInF5gU9oXNYgAAAAAQAAANUBAAAwggHRMIIBOqADAgECAhAT1EWwzeLBk0ez5Bg+JKyVMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNVBAMTCWxvY2FsaG9zdDAeFw0xMjExMTUxNTMyMDdaFw0xNzExMTUwMDAwMDBaMBQxEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtgkwd4GLTIwRtoHFjoSCBqrEcFgYMPh7f8aSWSYTrBGtaS9c2zOAuhxnaIAo1ELe3JLWUJmHq35IEu34gTwN9RfSna9Gis45TKrINY5nlAmKu0XpuI3ncf4WQRPbPx7hS6A0BHytXqQ3+FA1BSRr13iNUaaAkqwcCLWHXqno188CAwEAAaMkMCIwCwYDVR0PBAQDAgSwMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBBQUAA4GBACKXEQpUUVm1g3BfpqRSn9hIYpuLojPX2wfySbIAan4jK5oo0dC5QUkbRjyEtqe6Io+POL3gbtoVzJOXnUDvYDUXRaR6dUmHJ5A4JLChUJZLHis0resLKO5yXrf4JqJSwEsL4Et5xiIRPoEvdPWWBhkDwuMvDGtQrzpp6ZYEt2sh" />
                </identity>
            </endpoint>
        </client>
    </system.serviceModel>
</configuration>

我尝试启动控制台应用程序，但出现了应指定有效问题的错误。所以我想，可以在 Azure AD 配置页面的端点中找到有效的问题，并将 WS-Federation 单点登录端点复制为颁发者。

控制台程序代码如下。

var client = new SomeService.Service1Client();
            client.ClientCredentials.UserName.UserName = "<valid user name>";
            client.ClientCredentials.UserName.Password = "<password>";
            client.GetData(10);

当我调用服务时，我在 fiddler 中看到，该请求被发送到 WS-Fed 端点，但在响应端点中向我发送带有错误的 html 页面

AADSTS20012:当我们尝试处理 WS-Federation 消息时发生错误。该消息无效。

您能否建议我哪里错了，以及如何实现我在问题开头描述的场景？谢谢。

Answer 1

可以使用用户名和密码从 Azure AD 获取 token ，请参阅 http://www.cloudidentity.com/blog/2014/07/08/using-adal-net-to-authenticate-users-via-usernamepassword/ 。但请注意，正如 Brent 所强调的，这是通过 OAuth2 而不是 WS-Trust 完成的。您不能使用 WCF 机制，例如 createchannelwithissuedtoken 或类似机制。一般来说，Azure AD 和我们所有的现代库都不与 WCF 集成，而是专注于 Web API。WCF 集成在技术上是可行的，但需要对 WCF 可扩展性有非常深入的了解。如果您有机会重构您的服务以使用 Web API，您会发现一切都会变得容易得多。华泰五、