C# 在ASP.NET应用程序上编程配置Microsoft.IdentityModel不起作用-启用被动重定向但从未起作用

我正在开发一个基于声明的身份验证应用程序，希望将Microsoft.IdentityModel配置从web.config文件移动到我的代码中，以便动态管理配置

这是web.config中包含的federatedAuthentication部分：

<federatedAuthentication>
    <wsFederation passiveRedirectEnabled="true" issuer="trust" realm="real" requireHttps="false" />
    <cookieHandler requireSsl="true" />
</federatedAuthentication>

我已尝试在应用程序_Start（）方法中附加EventHandler，以实现代码中的配置，而不是web.config文件：

    protected void Application_Start()
    {
        FederatedAuthentication.ServiceConfigurationCreated += new EventHandler<ServiceConfigurationCreatedEventArgs>(FederatedAuthentication_ServiceConfigurationCreated);
    }

    private static void FederatedAuthentication_ServiceConfigurationCreated(Object sender, ServiceConfigurationCreatedEventArgs e)
    {
        const string rpRealm = "realm";
        const bool requireSsl = false;
        const bool requireHttps = false;
        const bool passRedirect = true;
        const string issuer = "trust";

        ...

        FederatedAuthentication.WSFederationAuthenticationModule.PassiveRedirectEnabled = passRedirect;
        FederatedAuthentication.WSFederationAuthenticationModule.Issuer = issuer;
        FederatedAuthentication.WSFederationAuthenticationModule.Realm = rpRealm;
        FederatedAuthentication.WSFederationAuthenticationModule.RequireHttps = requireHttps;

        ...
    }

受保护的无效应用程序\u Start（）
{
FederatedAuthentication.ServiceConfigurationCreated+=新事件处理程序（FederatedAuthentication\u ServiceConfigurationCreated）；
}
私有静态void联合身份验证\u ServiceConfigurationCreated（对象发送方，ServiceConfigurationCreatedEventArgs e）
{
常量字符串rpRealm=“realm”；
const bool requireSsl=false；
const bool requireHttps=false；
const bool passRedirect=true；
const string issuer=“信任”；
...
FederatedAuthentication.WSFederationAuthenticationModule.被动式DirectEnabled=passRedirect；
FederatedAuthentication.WSFederationAuthenticationModule.Issuer=颁发者；
FederatedAuthentication.WSFederationAuthenticationModule.Realm=rpRealm；
FederatedAuthentication.WSFederationAuthenticationModule.RequireHttps=RequireHttps；
...
}

当我删除web.config文件中的配置并生成代码时，出现了一个问题，即应用程序没有重定向到颁发者url，即使passiverDirectEnabled属性已设置为true

通过设置断点，我确认上面的代码确实运行过，并且没有生成异常；然而，被动重定向从未起作用

---

p.S.I使用WIF3.5；导入的程序集是Microsoft.IdentityModel.dll，我就是这样做的-创建一个FederationConfiguration对象，然后添加到它的WsFederationConfiguration属性，然后将整个内容设置为事件参数

  private static void FederatedAuthentication_FederationConfigurationCreated(object sender, FederationConfigurationCreatedEventArgs e)
{
    //from appsettings...
    const string allowedAudience = "http://audience1/user/get";
    const string rpRealm = "http://audience1/";
    const string domain = "";
    const bool requireSsl = false;
    const string issuer = "http://sts/token/create;
    const string certThumbprint = "mythumbprint";
    const string authCookieName = "StsAuth";

    var federationConfiguration = new FederationConfiguration();
                             federationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(allowedAudience));

    var issuingAuthority = new IssuingAuthority(internalSts);
    issuingAuthority.Thumbprints.Add(certThumbprint);
    issuingAuthority.Issuers.Add(internalSts);
    var issuingAuthorities = new List<IssuingAuthority> {issuingAuthority};

    var validatingIssuerNameRegistry = new ValidatingIssuerNameRegistry {IssuingAuthorities = issuingAuthorities};
    federationConfiguration.IdentityConfiguration.IssuerNameRegistry = validatingIssuerNameRegistry;
    federationConfiguration.IdentityConfiguration.CertificateValidationMode = X509CertificateValidationMode.None;

    var chunkedCookieHandler = new ChunkedCookieHandler {RequireSsl = false, Name = authCookieName, Domain = domain, PersistentSessionLifetime = new TimeSpan(0, 0, 30, 0)};
    federationConfiguration.CookieHandler = chunkedCookieHandler;
    federationConfiguration.WsFederationConfiguration.Issuer = issuer;
    federationConfiguration.WsFederationConfiguration.Realm = rpRealm;
    federationConfiguration.WsFederationConfiguration.RequireHttps = requireSsl;

    e.FederationConfiguration = federationConfiguration;

private static void federated身份验证\u FederationConfigurationCreated（对象发送方，FederationConfigurationCreatedEventArgs e）
{
//从应用程序设置。。。
允许访问的常量字符串=”http://audience1/user/get";
常量字符串rpRealm=”http://audience1/";
常量字符串域=”；
const bool requireSsl=false；
常量字符串颁发者=”http://sts/token/create;
常量字符串certThumbprint=“mythumbprint”；
常量字符串authCookieName=“StsAuth”；
var federationConfiguration=新的federationConfiguration（）；
federationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add（新Uri（allowedAudience））；
var发行权限=新发行权限（内部STS）；
发布权限.指纹.添加（证书指纹）；
发行机构。发行人。添加（内部STS）；
var issuingAuthorities=新列表{issuingAuthority}；
var validatingIssuerNameRegistry=new validatingIssuerNameRegistry{IssuingAuthorities=IssuingAuthorities}；
federationConfiguration.IdentityConfiguration.IssuerNameRegistry=验证IssuerNameRegistry；
federationConfiguration.IdentityConfiguration.CertificateValidationMode=X509CertificateValidationMode.None；
var chunkedCookieHandler=new chunkedCookieHandler{RequireSsl=false，Name=authCookieName，Domain=Domain，PersistentSessionLifetime=new TimeSpan（0,0,30,0）}；
federationConfiguration.CookieHandler=chunkedCookieHandler；
federationConfiguration.WsFederationConfiguration.Issuer=发卡机构；
federationConfiguration.WsFederationConfiguration.Realm=rpRealm；
federationConfiguration.WsFederationConfiguration.RequireHttps=requireSsl；
e、 FederationConfiguration=FederationConfiguration；

谢谢@jonho的热情帮助！不过您的代码在WIF 4.5中工作，而我在WIF 3.5中工作，这里的情况有点不同

在互联网上进行研究并使用我的代码进行测试后，我在微软的帮助下想出了一个可行的解决方案

为了防止人们像我一样陷入困境，以下是我所做的：

创建ServiceConfiguration时添加事件处理程序，并在事件处理程序中添加允许的访问群体和证书信息：

protected void Application_Start()
{
    FederatedAuthentication.ServiceConfigurationCreated += 
                new EventHandler<ServiceConfigurationCreatedEventArgs>(FederatedAuthentication_ServiceConfigurationCreated);
}

private static void FederatedAuthentication_ServiceConfigurationCreated(Object sender, ServiceConfigurationCreatedEventArgs e)
{
    const string allowedAudience = "allowed_aud";
    const string certThumbprint = "thumb";
    const string certName = "name";

    var serviceConfiguration = new ServiceConfiguration();

    serviceConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(allowedAudience));

    var issuerNameRegistry = new ConfigurationBasedIssuerNameRegistry();
    issuerNameRegistry.AddTrustedIssuer(certThumbprint, certName);
    serviceConfiguration.IssuerNameRegistry = issuerNameRegistry;
    serviceConfiguration.CertificateValidationMode = X509CertificateValidationMode.None;

    e.ServiceConfiguration = serviceConfiguration;
}

---

这应该足以使被动重定向在WIF 3.5中与ASP.NET应用程序一起工作，非常感谢！因为您的代码在WIF 4.5中工作，而我在WIF 3.5中工作，所以我对代码进行了调整，做了一些研究并提出了一个可行的解决方案！我也发布了我的答案。谢谢！X509CertificateValidationMode.None=>安全吗？我们已将指纹注册到颁发机构，因此验证应该无效…？@Guillaume“X509CertificateValidationMode.None”用于测试目的。之后我编写了一个自定义验证程序，并将其更改为“X509CertificateValidationMode.custom”“@Endri-是的。我这里有一个完整的工作原型，这是MVC 5。@jonho你的解决方案看起来很有趣。我正在尝试运行它，但无法创建指定的证书。链接重定向到另一篇文章。我正在使用VS 2015和windows 7。你能告诉我如何生成证书吗？

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
    FederatedAuthentication.SessionAuthenticationModule.CookieHandler.RequireSsl = requireSsl;
    FederatedAuthentication.WSFederationAuthenticationModule.Issuer = issuer;
    FederatedAuthentication.WSFederationAuthenticationModule.Realm = rpRealm;
    FederatedAuthentication.WSFederationAuthenticationModule.PassiveRedirectEnabled = passRedirect;
    FederatedAuthentication.WSFederationAuthenticationModule.RequireHttps = requireHttps;
}