Fatal编程技术网
  • asp.net-mvc/
  • Asp.net mvc MVC 5、WIF（系统识别模型）和；ADFS未实际进行身份验证，在联合注销时出错

Asp.net mvc MVC 5、WIF（系统识别模型）和；ADFS未实际进行身份验证，在联合注销时出错

asp.net-mvc visual-studio-2013

Asp.net mvc MVC 5、WIF（系统识别模型）和；ADFS未实际进行身份验证，在联合注销时出错,asp.net-mvc,visual-studio-2013,.net-4.5,wif,adfs,Asp.net Mvc,Visual Studio 2013,.net 4.5,Wif,Adfs,我正在Visual Studio 2013中创建一个基于声明的MVC站点 到目前为止，我学到了一些东西： 系统。标识已进入，Microsoft。标识已退出 包括微软4.5版指南在内的许多教程都过时了。例如，我认为添加模块/处理程序或任何东西都不需要对项目模板生成的.config文件进行任何更改 Visual Studio 2013中没有像2012年那样的Microsoft内置/加载项STS Thinktecture的EmbeddedSTS插件经常被推荐，听起来很酷，但是*：//Embedded

我正在Visual Studio 2013中创建一个基于声明的MVC站点

到目前为止，我学到了一些东西：

  • 系统。标识已进入，Microsoft。标识已退出
  • 包括微软4.5版指南在内的许多教程都过时了。例如，我认为添加模块/处理程序或任何东西都不需要对项目模板生成的.config文件进行任何更改
  • Visual Studio 2013中没有像2012年那样的Microsoft内置/加载项STS
  • Thinktecture的EmbeddedSTS插件经常被推荐，听起来很酷，但是*：//EmbeddedSTS/无法解决问题（？？我不明白）。此外，到其IdentityServer v2-的二进制链接当前已断开（？）
  • ADFS功能需要Windows Server 2012、一个域和自签名证书——如果您以前做过，这并不难，但如果您没有做过，则需要陡峭的学习曲线
  • ADFS需要SSL—Visual Studio 2013/IIS Express 8轻松支持SSL站点，只需确保端口号在44300-44398范围内即可
  • ADFS管理者依赖方界面建议引用“sts”和“ADFS/ls”之类的例子，我认为这是误导性的。实际上，他们应该直接指向你的应用程序（
    https://localhost:44300
    例如）。虽然我的还不能正常工作，所以这可能与我的错误有关
  • 创建新的VisualStudioWeb应用程序项目后，就没有工具可以更改身份验证机制。只需重新开始一个新项目，并将身份验证更改为组织帐户（对于内部部署，如我的情况）。要完成此向导，必须安装并访问STS（如ADFS安装）
  • 如果由于您没有将机器加入域的权限而在虚拟机中对测试ADFS DC进行黑客攻击，请使用
    hosts
    文件将虚拟机IP的DNS覆盖到预期的域名
  • “每次登录时都要求用户提供凭据”在处理首次登录注销问题时很有用
  • 我认为，如果你没有任何索赔规则，任何索赔，甚至身份，都不会通过
1） 是什么原因导致我的应用程序仍然认为用户未通过身份验证？ 我的
https://localhost:44300/Default/Index/
操作应该显示
User.Identity
（我也尝试了
Thread.CurrentPrincipal.Identity
）的详细信息，前提是用户已通过身份验证。我有一个登录操作链接，由以下内容生成：

var signIn = new SignInRequestMessage(new Uri("https://dc.ad.dev.local/adfs/ls/"), "https://localhost:44300");

return new RedirectResult(signIn.WriteQueryString());
单击此链接确实会将我带到ADFS登录页面。登录使我回到我的应用程序。在Chrome Bug中查看保留的网络活动显示，我有一条
RequestSecurityTokenResponse
消息被发回应用程序，但应用程序的
用户身份仍未验证

我配置了一个声明规则：将“传入声明”从“Windows帐户名”转换为“名称ID”，作为“临时标识符”。我在嗅探的
POST
中看到了
DevAD\jdoe
。我尝试了很多其他的索赔规则，但仍然没有得到认证

我没有任何用于吸收索赔的自定义代码我希望截获任何应用程序url上带有令牌的帖子，该帖子将由框架自动转换为
用户。身份
神奇地，可能是由Startup.Auth.cs中此向导生成的代码启动的：


app.UseActiveDirectoryFederationServicesBearerAuthentication(
    new ActiveDirectoryFederationServicesBearerAuthenticationOptions
    {
        Audience = ConfigurationManager.AppSettings["ida:Audience"],
        MetadataEndpoint = ConfigurationManager.AppSettings["ida:AdfsMetadataEndpoint"]
    });


但我有一部分怀疑这种期望。对吗？除了默认的路由url之外，MVC WIF是否还创建了一个特殊的已知路由来接受我应该使用的登录帖子

2） 如何成功注销？
我还有一个注销操作：


WSFederationAuthenticationModule.FederatedSignOut(new Uri("https://dc.ad.dev.local/adfs/ls/"), new Uri(Url.Action("Index", null, null, Request.Url.Scheme)));


但是在这个
https://dc.ad.dev.local/adfs/ls?wa=wsignout1.0&wreply=https%3a%2f%2flocalhost%3a44300%2f
page，“发生错误”。事件查看器显示#364：“在联合被动请求期间遇到错误。”

我的ADFS服务>证书都设置为相同的证书，我认为是正确的

================

顺便说一下，下面是被动发布到应用程序的内容，对吗？再说一次，它是自动吸收的吗


<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
    <t:Lifetime>
        <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2014-07-28T14:29:47.167Z</wsu:Created>
        <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2014-07-28T15:29:47.167Z</wsu:Expires>
    </t:Lifetime>
    <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
        <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
            <wsa:Address>https://localhost:44300/</wsa:Address>
        </wsa:EndpointReference>
    </wsp:AppliesTo>
    <t:RequestedSecurityToken>
        <saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="_e2399a27-acac-4390-aa8a-556f41fec2f2" Issuer="http://dc.ad.dev.local/adfs/services/trust" IssueInstant="2014-07-28T14:29:47.167Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
            <saml:Conditions NotBefore="2014-07-28T14:29:47.167Z" NotOnOrAfter="2014-07-28T15:29:47.167Z">
                <saml:AudienceRestrictionCondition>
                    <saml:Audience>https://localhost:44300/</saml:Audience>
                </saml:AudienceRestrictionCondition>
            </saml:Conditions>
            <saml:AttributeStatement>
                <saml:Subject>
                    <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">DevAD\jdoe</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
                <saml:Attribute AttributeName="name" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                    <saml:AttributeValue>jdoe</saml:AttributeValue>
                </saml:Attribute>
                <saml:Attribute AttributeName="givenname" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                    <saml:AttributeValue>John Doe</saml:AttributeValue>
                </saml:Attribute>
                <saml:Attribute AttributeName="upn" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                    <saml:AttributeValue>jdoe@ad.dev.local</saml:AttributeValue>
                </saml:Attribute>
            </saml:AttributeStatement>
            <saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" AuthenticationInstant="2014-07-28T14:29:47.152Z">
                <saml:Subject>
                    <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">DevAD\jdoe</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
            </saml:AuthenticationStatement>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                    <ds:Reference URI="#_e2399a27-acac-4390-aa8a-556f41fec2f2">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <ds:DigestValue>+ZDduF0CKxXq7P+diyAXN51mo549pvwo3BNCekWSEpk=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>VMjCbSZXw3YROHYQ1eCYH5D9UQl1tzqZ9Nw99FUK78A8TSLs1ns3G8PE1d1Z1db2KKpbnzExXSXG2elP3Z69OejSWjsywIFTPeGcbGk4BvrV4ZcHGCbYKN0Wg5pySMEqm4LV1E5k+32kuALveLi5fkQROyXudquvVRgYrgu7XBsfr96Uvqo1yWmAzhhpEorfe4Z0p4RurKRpS7IsrI9SkssGOdQV/89NQelIZSZzOEMfay/AxewBbQ8C46g/4NgygaaPsG8X52EFVftzFY0BM8k+aMMUiKrJ0Xo7tJCMxJLcQ3aJdLBRNybHaklFgtln0ZCSlYylglUjUZ5d66jGcg==</ds:SignatureValue>
                <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <X509Data>
                        <X509Certificate>MIIC7jCCAdagAwIBAgIQLB+dBr0GI75OvLElC1HZHTANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhBREZTIFNpZ25pbmcgLSBkYy5hZC5lbnRlcnByaXNlZGV2LmxvY2FsMB4XDTE0MDcyNDIxMTMxM1oXDTE1MDcyNDIxMTMxM1owMzExMC8GA1UEAxMoQURGUyBTaWduaW5nIC0gZGMuYWQuZW50ZXJwcmlzZWRldi5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALvkkbfrr5YZWNkfv7LFQlVj3qTcfduRltKfAGiK/NOXNp498uMY+zhUBtiPU1woJhsoqfahgQpy3YJhIPsxbVGSXjAGcFVcUq03V2xVJB6+tW1Ny+/lqiXrdvYAHcZvqpeG/tnh5/hGi/mapd2oMxWIWkyRdztJrN+BCzUi4mm80bYrYX8liuDAcJEk5EYh73gaOwzIyUAZvOXwX1UWh9FA8j2mIMyv3b4SgjFQMPT+Fyw4L1cX+3u/PhGlVRSUEAu+igfMxM1JTco+3HMfQuBZLGd8YXhig+6WbIGlcGUhHEdNSr9ymljJBaps1JfGZk7Rj/7hYeHCXbl3mKK7yFUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAU5gYs7BZZBrrm+eDZM5pTaQfnwyeHYWHe9D2UDweWTNjj9KVC2sucUI2K9MXzA3kZOP7UIvnLmHvxG7cnPen095NBIyYYDjzvlImGwq297m6cz0m2ZxkBGMKq9bVSPoVOgDrX0c+e2wFjRgVojd1bWm9fbMvIUWn8KyMQMquXmyJxX5sPxpMfm95yheyh6q67VzgWF9TcUp6jNdmMcRowHWnQ9UVYf1UEMcPUlaljARVQYNQjyHjrcFaRkxF57EkjO3e263KIe0knVNoz8W57prXJLOHOqSe2f4kSKUdU+Xt8XQbJ77xHPdSOoW8NwKZVL7/9TrfVJ6pi1Ob/+LrAA==</X509Certificate>
                    </X509Data>
                </KeyInfo>
            </ds:Signature>
        </saml:Assertion>
    </t:RequestedSecurityToken>
    <t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType>
    <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
    <t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
</t:RequestSecurityTokenResponse>




2014-07-28814:29:47.167Z
2014-07-28815:29:47.167Z
https://localhost:44300/
https://localhost:44300/
德瓦德\jdoe
urn:oasis:name:tc:SAML:1.0:cm:bearier
jdoe
无名氏
jdoe@ad.dev.local
德瓦德\jdoe
urn:oasis:name:tc:SAML:1.0:cm:bearier
+ZDduF0CKxXq7P+diyAXN51mo549pvwo3BNCekWSEpk=
2.文中给出了一个2-2 2 2-2 2 2-2 2-2 2-2 2-2 2-2 2-2 2-2 2-2 2-2-2 2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-1-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-JUZ5D66JGCG==
MIIC7jCCAdagAwIBAgIQLB+dBr0GI75OvLElC1HZ

<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
    <t:Lifetime>
        <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2014-07-28T14:29:47.167Z</wsu:Created>
        <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2014-07-28T15:29:47.167Z</wsu:Expires>
    </t:Lifetime>
    <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
        <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
            <wsa:Address>https://localhost:44300/</wsa:Address>
        </wsa:EndpointReference>
    </wsp:AppliesTo>
    <t:RequestedSecurityToken>
        <saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="_e2399a27-acac-4390-aa8a-556f41fec2f2" Issuer="http://dc.ad.dev.local/adfs/services/trust" IssueInstant="2014-07-28T14:29:47.167Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
            <saml:Conditions NotBefore="2014-07-28T14:29:47.167Z" NotOnOrAfter="2014-07-28T15:29:47.167Z">
                <saml:AudienceRestrictionCondition>
                    <saml:Audience>https://localhost:44300/</saml:Audience>
                </saml:AudienceRestrictionCondition>
            </saml:Conditions>
            <saml:AttributeStatement>
                <saml:Subject>
                    <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">DevAD\jdoe</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
                <saml:Attribute AttributeName="name" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                    <saml:AttributeValue>jdoe</saml:AttributeValue>
                </saml:Attribute>
                <saml:Attribute AttributeName="givenname" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                    <saml:AttributeValue>John Doe</saml:AttributeValue>
                </saml:Attribute>
                <saml:Attribute AttributeName="upn" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                    <saml:AttributeValue>jdoe@ad.dev.local</saml:AttributeValue>
                </saml:Attribute>
            </saml:AttributeStatement>
            <saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" AuthenticationInstant="2014-07-28T14:29:47.152Z">
                <saml:Subject>
                    <saml:NameIdentifier Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">DevAD\jdoe</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
            </saml:AuthenticationStatement>
            <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:SignedInfo>
                    <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                    <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                    <ds:Reference URI="#_e2399a27-acac-4390-aa8a-556f41fec2f2">
                        <ds:Transforms>
                            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                        </ds:Transforms>
                        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                        <ds:DigestValue>+ZDduF0CKxXq7P+diyAXN51mo549pvwo3BNCekWSEpk=</ds:DigestValue>
                    </ds:Reference>
                </ds:SignedInfo>
                <ds:SignatureValue>VMjCbSZXw3YROHYQ1eCYH5D9UQl1tzqZ9Nw99FUK78A8TSLs1ns3G8PE1d1Z1db2KKpbnzExXSXG2elP3Z69OejSWjsywIFTPeGcbGk4BvrV4ZcHGCbYKN0Wg5pySMEqm4LV1E5k+32kuALveLi5fkQROyXudquvVRgYrgu7XBsfr96Uvqo1yWmAzhhpEorfe4Z0p4RurKRpS7IsrI9SkssGOdQV/89NQelIZSZzOEMfay/AxewBbQ8C46g/4NgygaaPsG8X52EFVftzFY0BM8k+aMMUiKrJ0Xo7tJCMxJLcQ3aJdLBRNybHaklFgtln0ZCSlYylglUjUZ5d66jGcg==</ds:SignatureValue>
                <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                    <X509Data>
                        <X509Certificate>MIIC7jCCAdagAwIBAgIQLB+dBr0GI75OvLElC1HZHTANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhBREZTIFNpZ25pbmcgLSBkYy5hZC5lbnRlcnByaXNlZGV2LmxvY2FsMB4XDTE0MDcyNDIxMTMxM1oXDTE1MDcyNDIxMTMxM1owMzExMC8GA1UEAxMoQURGUyBTaWduaW5nIC0gZGMuYWQuZW50ZXJwcmlzZWRldi5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALvkkbfrr5YZWNkfv7LFQlVj3qTcfduRltKfAGiK/NOXNp498uMY+zhUBtiPU1woJhsoqfahgQpy3YJhIPsxbVGSXjAGcFVcUq03V2xVJB6+tW1Ny+/lqiXrdvYAHcZvqpeG/tnh5/hGi/mapd2oMxWIWkyRdztJrN+BCzUi4mm80bYrYX8liuDAcJEk5EYh73gaOwzIyUAZvOXwX1UWh9FA8j2mIMyv3b4SgjFQMPT+Fyw4L1cX+3u/PhGlVRSUEAu+igfMxM1JTco+3HMfQuBZLGd8YXhig+6WbIGlcGUhHEdNSr9ymljJBaps1JfGZk7Rj/7hYeHCXbl3mKK7yFUCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAU5gYs7BZZBrrm+eDZM5pTaQfnwyeHYWHe9D2UDweWTNjj9KVC2sucUI2K9MXzA3kZOP7UIvnLmHvxG7cnPen095NBIyYYDjzvlImGwq297m6cz0m2ZxkBGMKq9bVSPoVOgDrX0c+e2wFjRgVojd1bWm9fbMvIUWn8KyMQMquXmyJxX5sPxpMfm95yheyh6q67VzgWF9TcUp6jNdmMcRowHWnQ9UVYf1UEMcPUlaljARVQYNQjyHjrcFaRkxF57EkjO3e263KIe0knVNoz8W57prXJLOHOqSe2f4kSKUdU+Xt8XQbJ77xHPdSOoW8NwKZVL7/9TrfVJ6pi1Ob/+LrAA==</X509Certificate>
                    </X509Data>
                </KeyInfo>
            </ds:Signature>
        </saml:Assertion>
    </t:RequestedSecurityToken>
    <t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType>
    <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
    <t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType>
</t:RequestSecurityTokenResponse>