.net - 无法使 HTTPS MEX 端点工作

Question

我一直在尝试将 WCF 配置为与 Azure ACS 一起使用。此 WCF 配置有 2 个错误：

1. 它不发布 MEX 端点。
2. 它不调用自定义行为扩展。（在我做了一些我不记得的改变后，它就停止了）

这里可能有什么问题？

<configuration>
  <configSections>
    <section name="microsoft.identityModel"
             type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
  </configSections>
  <location path="FederationMetadata">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <system.web>
    <compilation debug="true" targetFramework="4.0">
      <assemblies>
        <add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
      </assemblies>
    </compilation>
  </system.web>
  <system.serviceModel>
    <services>
      <service name="production" behaviorConfiguration="AccessServiceBehavior">
        <endpoint contract="IMetadataExchange"
                  binding="mexHttpsBinding"
                  address="mex" />
        <endpoint address=""
                  binding="customBinding"
                  contract="Samples.RoleBasedAccessControl.Service.IService1"
                  bindingConfiguration="serviceBinding" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="AccessServiceBehavior">
          <federatedServiceHostConfiguration />
          <sessionExtension/>
          <useRequestHeadersForMetadataAddress>
            <defaultPorts>
              <add scheme="http" port="8000" />
              <add scheme="https" port="8443" />
            </defaultPorts>
          </useRequestHeadersForMetadataAddress>
          <!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
          <serviceMetadata httpsGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials>
            <!--Certificate added by FedUtil.  Subject='CN=DefaultApplicationCertificate', Issuer='CN=DefaultApplicationCertificate'.-->
            <serviceCertificate findValue="XXXXXXXXXXXXXXX" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
    <extensions>
      <behaviorExtensions>
        <add name="sessionExtension"
             type="Samples.RoleBasedAccessControl.Service.RsaSessionServiceBehaviorExtension, Samples.RoleBasedAccessControl.Service, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
        <add name="federatedServiceHostConfiguration"
             type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
      </behaviorExtensions>
    </extensions>
    <protocolMapping>
      <add scheme="http" binding="customBinding" bindingConfiguration="serviceBinding" />
      <add scheme="https" binding="customBinding" bindingConfiguration="serviceBinding"/>
    </protocolMapping>
    <bindings>
      <customBinding>
        <binding name="serviceBinding">
          <security authenticationMode="SecureConversation"
          messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"
          requireSecurityContextCancellation="false">
            <secureConversationBootstrap
              authenticationMode="IssuedTokenOverTransport"
              messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10">
              <issuedTokenParameters>
                <additionalRequestParameters>
                  <AppliesTo xmlns="http://schemas.xmlsoap.org/ws/2004/09/policy">
                    <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
                      <Address>https://127.0.0.1:81/</Address>
                    </EndpointReference>
                  </AppliesTo>
                </additionalRequestParameters>
                <claimTypeRequirements>
                  <add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="true" />
                  <add claimType="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" isOptional="true" />
                  <add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" isOptional="true" />
                  <add claimType="http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider" isOptional="true" />
                </claimTypeRequirements>
                <issuerMetadata address="https://XXXXYYYY.accesscontrol.windows.net/v2/wstrust/mex" />
              </issuedTokenParameters>
            </secureConversationBootstrap>
          </security>
          <httpsTransport />
        </binding>
      </customBinding>
    </bindings>
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
  </system.webServer>
  <microsoft.identityModel>
    <service>
      <audienceUris>
        <add value="http://127.0.0.1:81/" />
      </audienceUris>
      <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
        <trustedIssuers>
          <add thumbprint="THUMBPRINT HERE" name="https://XXXYYYY.accesscontrol.windows.net/" />
        </trustedIssuers>
      </issuerNameRegistry>
      <certificateValidation certificateValidationMode="None" />
    </service>
  </microsoft.identityModel>
  <appSettings>
    <add key="FederationMetadataLocation" value="https://XXXYYYY.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml " />
  </appSettings>
</configuration>

编辑：进一步的实现细节我有以下行为扩展元素（目前没有被调用）

 public class RsaSessionServiceBehaviorExtension : BehaviorExtensionElement
{
    public override Type BehaviorType
    {
        get
        {
            return typeof(RsaSessionServiceBehavior);
        }
    }
    protected override object CreateBehavior()
    {
        return new RsaSessionServiceBehavior();
    }
}

命名空间和程序集在配置中是正确的。检查令牌验证涉及更多代码，但我认为至少应该发布 MEX 并且应该调用 CreateBehavior() 以便我继续进行。