wcf-security - 从 ADFS 获取 token

Question

我正在尝试从 ADFS 获取 token ，以便我可以将它与本地 Windows 服务总线安装一起使用。我可能没有正确配置 ADFS，因为我收到以下消息:

MSIS3127:指定的请求失败。

访问 token 的代码如下:

    string adrecaSTS = "trust/13/usernamemixed";

    WS2007HttpBinding binding = new WS2007HttpBinding();

    binding.Security.Message.EstablishSecurityContext = false;
    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
    binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
    binding.Security.Mode = SecurityMode.TransportWithMessageCredential; //https

    string baseSSLUri = @"https://<myadfs>/adfs/services/";



    WSTrustChannelFactory trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(baseSSLUri + adrecaSTS));
    trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;
    trustChannelFactory.Credentials.UserName.UserName = "username";
    trustChannelFactory.Credentials.UserName.Password = "password";

    WSTrustChannel tokenClient = (WSTrustChannel)trustChannelFactory.CreateChannel();

    //create a token issuance issuance
    RequestSecurityToken rst = new RequestSecurityToken(RequestTypes.Issue);

    //call ADFS STS
    SecurityToken token = tokenClient.Issue(rst);

端点在 ADFS 上启用，我的客户端(单独域上的笔记本电脑)信任来自 ADFS 的证书。

我需要建立某种信任或进一步吗？此错误消息不是特别有用。

Answer 1

看这里:

https://github.com/thinktecture/Thinktecture.IdentityServer.v2/blob/master/src/Libraries/Thinktecture.IdentityServer.Protocols/WSFederation/HrdController.cs

ValidateToken 方法包含大部分代码 - 但您首先需要从通用 token 中提取 InnerXml 并将其转换为 SAML 安全 token (再次使用 token 处理程序)。