Rest 在运行时为web服务设置域和颁发者（windows azure ACS）

我们的项目中有这样的场景

我们有租户-1到租户-n，它们使用Restful服务S1。租户与IDP之间存在1:1的关系。客户机必须通过使用ACS的Restful服务，在ACS中配置的特定于租户的IDP的帮助下，联合租户UI

租户-1映射到IdP1（例如：Yahoo） 租户2映射到Idp2（例如：谷歌）

Restful服务将JavaScript作为JSON返回，该JSON托管在租户的Web UI中。因此，如果承租人已经通过自己的应用程序使用特定于他的IDP登录到承租人UI，那么对于承租人UI到Restful服务的任何请求，Restful服务应该根据在入职过程中配置的合作伙伴信息（承租人到IDP的映射）联合到特定于承租人的IDP

我正在Global.asax中设置领域，如下所示

public class WebApiApplication : System.Web.HttpApplication
{

    public event EventHandler RedirectingToIdentityProvider;

    public override void Init()
    {
        FederatedAuthentication.WSFederationAuthenticationModule.RedirectingToIdentityProvider += WSFederationAuthenticationModule_RedirectingToIdentityProvider;
    }

    void WSFederationAuthenticationModule_RedirectingToIdentityProvider(object sender, RedirectingToIdentityProviderEventArgs e)
    {
        Tenant tenant = GetTenantDetails(subId); // Gets the tenant information from MetaData based on subscriptionId

        if (tenant != null)
        {
            e.SignInRequestMessage.Realm = tenant.Realm + "CMS/";
        }

    }

    protected void Application_Start()
    {
        FederatedAuthentication.FederationConfigurationCreated += OnServiceConfigurationCreated;
    }

    private void OnServiceConfigurationCreated(object sender, FederationConfigurationCreatedEventArgs e)
    {

        if (tenant != null)
        {
            e.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            Uri uri = new Uri(tenant.Realm + "CMS/");
            if (!e.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
                e.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));
            e.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";
        }            
    }

public class MetaDataModule : IHttpModule
{

    private static string WSFederationAuthenticationModuleName = string.Empty;

    public void Init(HttpApplication httpContextApplication)
    {
        var requestWrapper = new EventHandler(DoSyncRequestWorkToGetTenantDetails);
        httpContextApplication.BeginRequest += requestWrapper;
    }

    private static void DoSyncRequestWorkToGetTenantDetails(object sender, EventArgs e)
    {
        var httpContextApplication = (HttpApplication)sender;
        Tenant tenant = GetTenantDetails(); // Gets the tenant information from MetaData based on subscriptionId

        if (tenant != null)
        {
            WSFederationAuthenticationModule wsfed = (WSFederationAuthenticationModule)httpContextApplication.Modules["WSFederationAuthenticationModule"];
            wsfed.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            Uri uri = new Uri(tenant.Realm + "CMS/");
            if (!wsfed.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
                wsfed.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));

            wsfed.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";

            //FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            //Uri uri = new Uri(tenant.Realm + "CMS/");
            //if (!FederatedAuthentication.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
            //    FederatedAuthentication.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));

            //FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";
        }
    }

此外，领域也设置为每个请求级别，如下所示

public class WebApiApplication : System.Web.HttpApplication
{

    public event EventHandler RedirectingToIdentityProvider;

    public override void Init()
    {
        FederatedAuthentication.WSFederationAuthenticationModule.RedirectingToIdentityProvider += WSFederationAuthenticationModule_RedirectingToIdentityProvider;
    }

    void WSFederationAuthenticationModule_RedirectingToIdentityProvider(object sender, RedirectingToIdentityProviderEventArgs e)
    {
        Tenant tenant = GetTenantDetails(subId); // Gets the tenant information from MetaData based on subscriptionId

        if (tenant != null)
        {
            e.SignInRequestMessage.Realm = tenant.Realm + "CMS/";
        }

    }

    protected void Application_Start()
    {
        FederatedAuthentication.FederationConfigurationCreated += OnServiceConfigurationCreated;
    }

    private void OnServiceConfigurationCreated(object sender, FederationConfigurationCreatedEventArgs e)
    {

        if (tenant != null)
        {
            e.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            Uri uri = new Uri(tenant.Realm + "CMS/");
            if (!e.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
                e.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));
            e.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";
        }            
    }

public class MetaDataModule : IHttpModule
{

    private static string WSFederationAuthenticationModuleName = string.Empty;

    public void Init(HttpApplication httpContextApplication)
    {
        var requestWrapper = new EventHandler(DoSyncRequestWorkToGetTenantDetails);
        httpContextApplication.BeginRequest += requestWrapper;
    }

    private static void DoSyncRequestWorkToGetTenantDetails(object sender, EventArgs e)
    {
        var httpContextApplication = (HttpApplication)sender;
        Tenant tenant = GetTenantDetails(); // Gets the tenant information from MetaData based on subscriptionId

        if (tenant != null)
        {
            WSFederationAuthenticationModule wsfed = (WSFederationAuthenticationModule)httpContextApplication.Modules["WSFederationAuthenticationModule"];
            wsfed.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            Uri uri = new Uri(tenant.Realm + "CMS/");
            if (!wsfed.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
                wsfed.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));

            wsfed.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";

            //FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.Issuer = tenant.Issuer;
            //Uri uri = new Uri(tenant.Realm + "CMS/");
            //if (!FederatedAuthentication.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Contains(uri))
            //    FederatedAuthentication.FederationConfiguration.IdentityConfiguration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(tenant.Realm + "CMS/"));

            //FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.Realm = tenant.Realm + "CMS/";
        }
    }

请查找Web.config中注册的模块以及WIF配置的其余部分

尽管为每个请求重置了域，但不会分配新值

客户端不希望他们的租户从他们的终端实现任何身份验证或与联盟相关的代码，以使其工作

---

请让我知道您是否可以在被动联合的帮助下想出任何解决方案。

您应该在Global.asax中的Application\u AuthenticateRequest方法中自定义域。 看看这个