1

我有一个自定义 STS，它具有在本地机器上运行良好的活动联合端点。本地 URL 是“https://localhost/CustomIDP/Service.svc”

在获取 SAML 令牌的最后一步在 Azure 上托管后，我在从 STS 获取令牌时收到以下错误：

[System.ServiceModel.CommunicationException] {“接收对“https:// mysts .cloudapp.net/Service.svc”的 HTTP 响应时发生错误。这可能是由于服务端点绑定未使用 HTTP 协议。这也可能是由于服务器中止了 HTTP 请求上下文（可能是由于服务关闭）。有关更多详细信息，请参阅服务器日志。"}

InnerException：[System.Net.WebException]：{“底层连接已关闭：接收时发生意外错误。”}

InnerException: [System.IO.IOException]:{"无法从传输连接中读取数据：现有连接被远程主机强行关闭。"}

InnerException：[System.Net.Sockets.SocketException]：{“现有连接被远程主机强制关闭”}：在 System.Net.Sockets.Socket.Receive(Byte[] 缓冲区，Int32 偏移量，Int32 大小，SocketFlags socketFlags）在 System.Net.Sockets.NetworkStream.Read（字节 [] 缓冲区，Int32 偏移量，Int32 大小）

感谢任何输入。请在下面找到用于调用 STS 以获取 SAML 令牌的代码片段。错误发生在 channel.Issue 语句中。

        using (var factory = new WSTrustChannelFactory(
            new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
            new EndpointAddress(new Uri(stsEndpoint))))
        {
            factory.Credentials.UserName.UserName = username;
            factory.Credentials.UserName.Password = password;
            factory.TrustVersion = TrustVersion.WSTrust13;

            WSTrustChannel channel = null;

            try
            {
                var rst = new RequestSecurityToken
                              {
                                  RequestType = WSTrust13Constants.RequestTypes.Issue,
                                  AppliesTo = new EndpointAddress(realm),
                                  KeyType = KeyTypes.Bearer,
                              };

                channel = (WSTrustChannel)factory.CreateChannel();

                return channel.Issue(rst);
            }
            finally
            {
                if (channel != null)
                {
                    channel.Abort();
                }

                factory.Abort();
            }
        }

Azure 上托管的 STS 服务的服务配置：

<system.serviceModel>
    <services>
      <service name="Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract" behaviorConfiguration="ServiceBehavior">
        <endpoint address="" binding="ws2007HttpBinding" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrust13SyncContract"  bindingConfiguration="ws2007HttpBindingConfiguration"/>
        <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" />
      </service>
    </services>
    <bindings>
      <ws2007HttpBinding>
        <binding name="ws2007HttpBindingConfiguration">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName" establishSecurityContext="false" />
          </security>
        </binding>
      </ws2007HttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior name="ServiceBehavior">
          <serviceMetadata httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="false" />
          <serviceCredentials>
            <serviceCertificate x509FindType="FindByThumbprint" findValue="[thumbprint]" storeLocation="LocalMachine" storeName="My" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>

  <microsoft.identityModel>
    <service>
      <!-- User name and password are not authenticated by windows authentication but a custom verification is done -->
      <securityTokenHandlers>
        <remove type="Microsoft.IdentityModel.Tokens.WindowsUserNameSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        <add type="ActiveIdPSite.CustomUserNameSecurityTokenHandler, ActiveIdPSite" />
      </securityTokenHandlers>
      <serviceCertificate>
        <certificateReference x509FindType="FindByThumbprint" findValue="[thumbprint]" storeLocation="LocalMachine" storeName="My" />
      </serviceCertificate>
      <certificateValidation certificateValidationMode="None" />
    </service>
  </microsoft.identityModel>
4

1 回答 1

0

问题解决了。根本原因与证书有关。

1.在部署时启用 WCF 诊断。2.获取 svclog 文件并使用 Microsoft Service Trace viewer 打开。

这是 svclog 的摘录。

回复操作引发异常：System.NotSupportedException - X.509 证书中不存在私钥

由于证书没有可导出格式的私钥，因此无法读取私钥。

使用了这里提到的修复：http: //social.msdn.microsoft.com/Forums/en/Geneva/thread/2b2681af-838e-4f22-84fa-b5494b9dcc02

于 2012-12-14T05:12:15.247 回答