All geek questions in one place

WCF Claims, ADFS 3.0

I am trying to understand what I need to develop a framework using WCF, Claims and ADFS 3.0. Internal users will be authenticated against Active Directory, external user authentication against the SQL Server table, and authorization are stored in database tables that implement groups and permissions. I am creating an API using WCF, not Web Api or OWIN.

I'm not interested in using Identity Server products or third-party products, I just want to know how I create a user security token service to read from my membership table and set claims in my Groups and Permissions table.

I can not find any information about this. In Visual Studio 2015 there is no identity and access control and it seems nothing is being used with WCF, only using Web Api, OWIN and MVC?

+4
source share
2 answers

This article seems to be good for you, http://southworks.com/blog/2007/03/11/the-holly-grail-of-enterprise-soa-security/

and here is the code that I use in my MVC application (not WCF, but many of the things that need to be done are the same)

var claims = new List<Claim>()
            {
                new Claim(ClaimTypes.Name, result.UserName),
                new Claim("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", result.Email),
                new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider",
                    result.Email),
                new Claim("UserId", result.Id.ToString(CultureInfo.InvariantCulture)),
                new Claim("UserName", result.UserName),
                new Claim("FirstName", result.FirstName)
            };

        //load claims from database here
        claims.AddRange(result.Roles.Select(role => new Claim(ClaimTypes.Role, role.Name)));

        var id = new ClaimsIdentity(claims, "Forms");
        var cp = new ClaimsPrincipal(id);
        var token = new SessionSecurityToken(cp)
        {
            IsPersistent = false

        };

        Session["authToken"] = token;

        var sam = FederatedAuthentication.SessionAuthenticationModule;
        sam.WriteSessionTokenToCookie(token);
+1
source

, WCF , , . , , - ADFS 3.0.

, ADFS , SQL " " . , , , ADFS .

, Aware WCF - .

, - , .Net 4.5 4.6 WIF , , WIF.

WCF:

<bindings>
    <ws2007FederationHttpBinding>
        <binding name="ws2007FederationHttpBinding">
            <security mode="TransportWithMessageCredential">
                <message establishSecurityContext="false" negotiateServiceCredential="false">
                    <issuerMetadata address="https://<adfs server>:9643/adfs/services/trust/mex"/>
                    <issuer address="https://<asfs aserver>:9643/adfs/services/trust/13/usernamemixed"/>
                </message>
            </security>
        </binding>
    </ws2007FederationHttpBinding>
</bindings>


<system.identityModel>
    <identityConfiguration name="serviceidentity">
        <audienceUris mode="Never">
            <add value="https://localhost/FedSecurity/"/>
        </audienceUris>
        <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
            <authority name="http://<asfs aserver>:9643/adfs/services/trust">
                <keys >
                    <add thumbprint="8D6BF173ERERERFDFE9CE9CD0FB57FB57A5D68403EA88" name="http://<asfs aserver>:9643/adfs/services/trust" />
                </keys>
                <validIssuers>
                    <add name="http://<asfs aserver>:9643/adfs/services/trust" />
                </validIssuers>
            </authority>
        </issuerNameRegistry>
        <!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
        <certificateValidation certificateValidationMode="None" />
    </identityConfiguration>
</system.identityModel>

WCF-

<system.serviceModel>
        <bindings>
            <ws2007FederationHttpBinding>
                <binding name="ws2007FederationHttpBinding">
                    <security mode="TransportWithMessageCredential">
                        <message establishSecurityContext="false">
                            <issuer address="https://<adfs server>:9643/adfs/services/trust/13/usernamemixed"
                                binding="ws2007HttpBinding" bindingConfiguration="https://<adfs server>:9643/adfs/services/trust/13/usernamemixed" />
                            <issuerMetadata address="https://<adfs server>:9643/adfs/services/trust/mex" />
                            <tokenRequestParameters>
                                <trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                                    <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType>
                                    <trust:KeySize xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">256</trust:KeySize>
                                    <trust:KeyWrapAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</trust:KeyWrapAlgorithm>
                                    <trust:EncryptWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptWith>
                                    <trust:SignWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2000/09/xmldsig#hmac-sha1</trust:SignWith>
                                    <trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/10/xml-exc-c14n#</trust:CanonicalizationAlgorithm>
                                    <trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
                                </trust:SecondaryParameters>
                            </tokenRequestParameters>
                        </message>
                    </security>
                </binding>
            </ws2007FederationHttpBinding>
            <ws2007HttpBinding>
                <binding name="https://<adfs server>:9643/adfs/services/trust/13/usernamemixed">
                    <security mode="TransportWithMessageCredential">
                        <transport clientCredentialType="None" />
                        <message clientCredentialType="UserName" establishSecurityContext="false" />
                    </security>
                </binding>
            </ws2007HttpBinding>
        </bindings>
        <client>
            <endpoint address="https://localhost/FedSecurity/CloudService.svc"
                binding="ws2007FederationHttpBinding" bindingConfiguration="ws2007FederationHttpBinding"
                contract="CloudBeta.ICloudSevice" name="ws2007FederationHttpBinding" />
        </client>
</system.serviceModel>

:

  • ADFS 2.0 UserName ,
  • , .
  • / ( AFDS).
  • ADFS

, !

+3

Source: https://habr.com/ru/post/1608682/

More articles:


All Articles