MVC中的Ws-Federation身份验证在SAML2.0验证后不保留声明信息

Question

我正在尝试使用Azure ACS添加新的auth方法来支持ADFS中的用户,但我遇到了一个非常具体的问题.

我可以使用以下配置验证SAML2.0:

var audienceRestriction = new AudienceRestriction(AudienceUriMode.Never);
var issuerRegistry = new ConfigurationBasedIssuerNameRegistry();
issuerRegistry.AddTrustedIssuer("XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "https://XXXX.accesscontrol.windows.net/");
app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
{
    MetadataAddress = "https://XXXXX.accesscontrol.windows.net/federationmetadata/2007-06/federationmetadata.xml",
    Wtrealm = "http://someurl/",
    SecurityTokenHandlers = new SecurityTokenHandlerCollection
    {
        new EncryptedSecurityTokenHandlerEx(new X509CertificateStoreTokenResolver(StoreName.My,StoreLocation.LocalMachine)),
        new SamlSecurityTokenHandlerEx
        {
            CertificateValidator = X509CertificateValidator.None,
            Configuration = new SecurityTokenHandlerConfiguration()
            {
                IssuerNameRegistry = issuerRegistry,
                AudienceRestriction = audienceRestriction
            }
        }
    },
});

使用这样的处理程序:

public class SamlSecurityTokenHandlerEx : Saml2SecurityTokenHandler, ISecurityTokenValidator
{
    public override bool CanReadToken(string securityToken)
    {
        return base.CanReadToken(XmlReader.Create(new StringReader(securityToken)));
    }

    public ClaimsPrincipal ValidateToken(string securityToken, TokenValidationParameters validationParameters,
        out SecurityToken validatedToken)
    {
        validatedToken = ReadToken(new XmlTextReader(new StringReader(securityToken)), Configuration.ServiceTokenResolver);
        var claims = new ClaimsPrincipal(ValidateToken(validatedToken));

        return claims;
    }

    public int MaximumTokenSizeInBytes { get; set; }
}

如果我检查ValidateToken中的声明它是经过身份验证和我想要的声明,但在它调用回调页面后(我想为webapp创建一个新的正确登录)它不再有任何关于Federated身份验证的信息.

Answer 1

解决了！

我从与其他外部身份验证提供商相同的机制启动 ACS 页面，但由于某种原因它失败了。调用 ACS 登录页面（https://someacs.accesscontrol.windows.net:443/v2/wsfederation?wa=wsignin1.0&wtrealm=https%3a%2f%2fsomeappsite%2f）直接解决了我的问题。