2

这是使用 WSTrustChannelFactory 获取令牌的示例。从这里。

var stsBinding = new WS2007HttpBinding();
stsBinding.Security.Mode = SecurityMode.TransportWithMessageCredential;
stsBinding.Security.Message.EstablishSecurityContext = false;
stsBinding.Security.Message.NegotiateServiceCredential = false;
stsBinding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;


WSTrustChannelFactory trustChannelFactory = new WSTrustChannelFactory(
    stsBinding
    , new EndpointAddress(tokenurl)
    );
trustChannelFactory.TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13;

X509Store myStore = new X509Store(StoreName.My, StoreLocation.LocalMachine);
myStore.Open(OpenFlags.ReadOnly);
X509Certificate2Collection coll = myStore.Certificates.Find(X509FindType.FindBySerialNumber, "MycertSerialNumber", true);
X509Certificate2 cert = coll[0];
trustChannelFactory.Credentials.ClientCertificate.Certificate = cert;

WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();

RequestSecurityToken rst = new RequestSecurityToken(RequestTypes.Issue, keyType);
rst.AppliesTo = new EndpointAddress(realm);
RequestSecurityTokenResponse rstr = null;
rst.TokenType = SecurityTokenTypes.Saml;

SecurityToken token = channel.Issue(rst, out rstr);

现在我没有用户名/密码，但提供商给了我证书 .pfx 文件。如何将它传递给 WSTrushChannelFactory？我试过使用 CertificateBinding 但没有成功。

上面更新的代码：2014 年 11 月 5 日：

收到此错误：ID3242：无法对安全令牌进行身份验证或授权。

4

2 回答 2

1

使用ClientCertificate属性：

var stsBinding = new WS2007HttpBinding();
stsBinding.Security.Mode = SecurityMode.TransportWithMessageCredential;
stsBinding.Security.Message.EstablishSecurityContext = false;
stsBinding.Security.Message.NegotiateServiceCredential = false;

// select the authentication mode of Client Certificate
stsBinding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;

var wifChannelFactory = new WSTrustChannelFactory(stsBinding, stsEndpoint);
wifChannelFactory.TrustVersion = TrustVersion.WSTrust13;

// Supply the credentials
wifChannelFactory.Credentials.ClientCertificate.Certificate = config.Certificate;

您可以通过管理单元导入证书存储的 PFX certmgr.msc。确保您的应用程序正在运行的帐户可以访问私钥。您可以使用类在商店中引用它。x509certificate2

于 2014-11-05T06:32:53.990 回答
0

干得好。

private static SecurityToken RequestSecurityToken()    
{    
    // set up the ws-trust channel factory    
    var factory = new WSTrustChannelFactory(    
        new UserNameWSTrustBinding(
          SecurityMode.TransportWithMessageCredential),    
          _idpAddress);    
    factory.TrustVersion = TrustVersion.WSTrust13;            

    var authCertificate = X509.LocalMachine.My.Thumbprint.Find(Properties.Settings.Default.RassCertificateThumbprint).FirstOrDefault();
    if (authCertificate == null)
        throw new InternalException(String.Format("No atuhentication certificate found in store with thumbprint {0}.", Properties.Settings.Default.ClientCertificateThumbprint));

    // overenie je na zaklade certifikatu RASS
    factory.Credentials.ClientCertificate.Certificate = authCertificate;

    // create token request  
    var rst = new RequestSecurityToken    
    {    
        RequestType = RequestTypes.Issue,
        KeyType = KeyTypes.Symmetric,    
        AppliesTo = new EndpointReference(_serviceAddress.AbsoluteUri)    
    };

    // request token and return
    return factory.CreateChannel().Issue(rst);    
}

顺便说一句：@Mitch 关于访问私钥是正确的。我只是采用了您的方法并替换了几行代码。

于 2014-11-05T10:18:19.210 回答