如何为wso2安全令牌服务创建.NET客户端

Question

我需要为wso2安全令牌服务创建一个.NET客户端.

通常我会创建一个简单的控制台或WinForm项目添加一个服务引用.暴露的WSDL将被转换为一组类,我可以使用它们来查询服务并正确管理其响应.

不幸的是,生成的请求和响应类是空的:只是没有任何属性或方法的类声明.这类似于其他(未答复)Stack Overflow问题中描述的行为/sf/ask/1543435631/

我在这个论坛帖子中找到了该服务的示例请求:http://cxf.547215.n5.nabble.com/Sample-STS-Client-tp4643980p4664175.html我使用它来使用SOAP UI.

是否有一种适当的,可能是自动的方式来重新创建查询安全令牌服务所需的复杂数据结构？

编辑

好的,经过多次尝试,我已经将SOAP请求从上面的论坛帖子减少到了仍然从STS服务获得RequestSecurityTokenResponse所需的最小结构.

    <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
  <soap:Header xmlns:wsa="http://www.w3.org/2005/08/addressing">
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
      <wsse:UsernameToken wsu:Id="UsernameToken-6D35592DCDDA26FFF3141578725699577">
        <wsse:Username>USERNAME HERE</wsse:Username>
        <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">PASSWORD HERE</wsse:Password>
      </wsse:UsernameToken>
      <wsu:Timestamp wsu:Id="TS-6D35592DCDDA26FFF3141578725699576">
        <wsu:Created>2014-11-12T10:14:16.995Z</wsu:Created>
        <wsu:Expires>2014-11-12T10:16:16.995Z</wsu:Expires>
      </wsu:Timestamp>
    </wsse:Security>
    <wsa:Action soap:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT</wsa:Action>
    <wsa:MessageID soap:mustUnderstand="1">uuid:6d4eab69-77f9-42b7-8d6b-1f710020fb0b</wsa:MessageID>
    <wsa:To soap:mustUnderstand="1">STS ENDPOINT ADDRESS HERE</wsa:To>
  </soap:Header>
  <soap:Body>
    <wst:RequestSecurityToken xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust">
      <wst:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</wst:RequestType>
      <wst:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</wst:TokenType>
      <wst:Claims>
        <wsid:ClaimType Uri="http://wso2.org/claims/userid" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity"/>
      </wst:Claims>
    </wst:RequestSecurityToken>
  </soap:Body>
</soap:Envelope>

我已经获得了部分成功,在我的项目的app.config中定义了单个wsHttpBinding,如下所示:

  <wsHttpBinding>
    <binding name="SendUsername"  messageEncoding="Text">
      <security mode ="TransportWithMessageCredential">
        <message clientCredentialType ="UserName"/>
        <transport clientCredentialType ="Basic" />
      </security>
    </binding>
  </wsHttpBinding>

添加或不添加如下所示的CustomBinding:

<customBinding>
     <binding name="wso2carbon-stsSoap12Binding">
      <security defaultAlgorithmSuite="Default" authenticationMode="IssuedToken"
        requireDerivedKeys="true" securityHeaderLayout="Lax" includeTimestamp="true">
        <localClientSettings detectReplays="false" />
        <localServiceSettings detectReplays="false" />
        <issuedTokenParameters keyType ="SymmetricKey" tokenType ="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
          <issuer address =STS ENDPOINT ADDRESS HERE binding ="wsHttpBinding" bindingConfiguration ="SendUsername"/>
          <claimTypeRequirements>
            <add claimType ="http://wso2.org/claims/userid"/>
          </claimTypeRequirements>
        </issuedTokenParameters>
      </security>
      <textMessageEncoding messageVersion="Soap12" />
      <httpsTransport />
    </binding>
  </customBinding>

但是在这两种情况下,请求都会抛出超时异常,并且在WCF跟踪已发出的请求时进行检查,我可以看到它缺少Claims元素.任何提示？

Answer 1

经过许多天与 WCF 配置选项的斗争，我取得了部分成功。

让我能够从安全令牌服务获得响应的关键是我意识到，从长远来看，我将需要在联合安全场景中进行操作。我本身不需要令牌，但我需要它来获取对其他服务进行身份验证的方法。

考虑到这个选项，我开始探索 WCF 必须为这种场景提供什么，并构建了以下配置选项：

  <wsFederationHttpBinding>
    <binding name="fs">
      <security mode="TransportWithMessageCredential">
        <message issuedKeyType="SymmetricKey" issuedTokenType ="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0">
          <issuer address = <!-- STS address here --> binding ="customBinding" bindingConfiguration ="StsBinding"/>
          <claimTypeRequirements>
            <add claimType="http://wso2.org/claims/userid" />
          </claimTypeRequirements>
        </message>
      </security>
    </binding>
  </wsFederationHttpBinding>

上面的绑定用于联系需要令牌身份验证的服务，而下面添加了有关如何联系安全令牌颁发者的进一步说明：

  <customBinding>
    <binding name="StsBinding">
      <textMessageEncoding messageVersion="Soap12WSAddressingAugust2004"/>
      <useManagedPresentation/>
      <security authenticationMode="UserNameOverTransport" includeTimestamp ="true" keyEntropyMode ="ServerEntropy" securityHeaderLayout ="Lax"   
                messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" >
      </security>
      <httpsTransport authenticationScheme ="Basic"/>
    </binding>
  </customBinding>

通过此配置，并在 Fiddler 和 WCF 跟踪的帮助下，我可以看到我从 STS 颁发者处获得了安全令牌响应。

然而，正如我所说，在一开始，这只是部分成功，因为 WCF 基础设施在处理令牌时表示它有一个错误的操作......但这可能是另一个问题的主题;-)

我希望这可以被认为是一个有效的答案，尽管我对令牌身份验证的追求尚未结束