1

我有一个使用Windows Authentication Service的 IdentityServer3 。现在我想在我的 IdentityServer3 上处理 SAML2 协议，我看到Kentor可以为我做这件事。

问题是 Kentor 在所有示例中都使用 OpenID Connect，我搜索了一段时间，但找不到任何有关如何将 Kentor 与 WindowsAuth 结合使用的文档。经过多次尝试都没有成功，我来这里询问是否真的有可能以及如何？

这是我在 Startup.cs 中的（非工作）配置：

public void Configuration(IAppBuilder appBuilder)
{
    appBuilder.Map("/windows", ConfigureWindowsTokenProvider);
    appBuilder.UseIdentityServer(GetIdentityServerOptions());
}

private void ConfigureWsFederation(IAppBuilder pluginApp, IdentityServerOptions options)
{
    var factory = new WsFederationServiceFactory(options.Factory);

    factory.Register(new Registration<IEnumerable<RelyingParty>>(RelyingParties.Get()));
    factory.RelyingPartyService = new Registration<IRelyingPartyService>(typeof(InMemoryRelyingPartyService));
    factory.CustomClaimsService = new Registration<ICustomWsFederationClaimsService>(typeof(ClaimsService));
    factory.CustomRequestValidator = new Registration<ICustomWsFederationRequestValidator>(typeof(RequestValidator));

    var wsFedOptions = new WsFederationPluginOptions
    {
        IdentityServerOptions = options,
        Factory = factory,
    };

    pluginApp.UseWsFederationPlugin(wsFedOptions);
}

private IdentityServerOptions GetIdentityServerOptions()
{
    DefaultViewServiceOptions viewServiceOptions = new DefaultViewServiceOptions();
    viewServiceOptions.CustomViewDirectory = HttpContext.Current.Server.MapPath("~/Templates");
    viewServiceOptions.Stylesheets.Add("/Content/Custom.css");

    IdentityServerServiceFactory factory = new IdentityServerServiceFactory()
        .UseInMemoryClients(new List<Client>())
        .UseInMemoryScopes(new List<Scope>());

    factory.ConfigureDefaultViewService(viewServiceOptions);
    factory.UserService = new Registration<IUserService>(resolver => new UserService());

    return new IdentityServerOptions
    {
        SigningCertificate = Certificate.Load(),
        Factory = factory,
        PluginConfiguration = ConfigureWsFederation,
        EventsOptions = new EventsOptions
        {
            RaiseSuccessEvents = true,
            RaiseFailureEvents = true,
        },
        AuthenticationOptions = new IdentityServer3.Core.Configuration.AuthenticationOptions
        {
            IdentityProviders = ConfigureIdentityProviders,
            EnableLocalLogin = false,
        },
        RequireSsl = true,
    };
}

private void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
{
    ConfigureWSFederationProvider(app, signInAsType);
    ConfigureKentorProvider(app, signInAsType);
}

private void ConfigureKentorProvider(IAppBuilder app, string signInAsType)
{
    SPOptions spOptions = new SPOptions
    {
        EntityId = new EntityId("Dropbox"),
    };
    KentorAuthServicesAuthenticationOptions kentorOptions = new KentorAuthServicesAuthenticationOptions(false)
    {
        Caption = "Windows",
        SignInAsAuthenticationType = signInAsType,
        SPOptions = spOptions,
    };
    IdentityProvider idp = new IdentityProvider(new EntityId("http://stubidp.kentor.se/Metadata"), spOptions)
    {
        Binding = Saml2BindingType.HttpRedirect,
        AllowUnsolicitedAuthnResponse = true,
        LoadMetadata = true,
    };
    kentorOptions.IdentityProviders.Add(idp);
    app.UseKentorAuthServicesAuthentication(kentorOptions);
}

private void ConfigureWSFederationProvider(IAppBuilder app, string signInAsType)
{
    app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions()
    {
        AuthenticationType = "windows",
        Caption = "Windows",
        SignInAsAuthenticationType = signInAsType,

        MetadataAddress = serverHost + "windows",
        Wtrealm = "urn:idsrv3",
    });
}

private void ConfigureWindowsTokenProvider(IAppBuilder app)
{
    app.UseWindowsAuthenticationService(new WindowsAuthenticationOptions
    {
        IdpReplyUrl = serverHost,
        SigningCertificate = Certificate.Load(),
        EnableOAuth2Endpoint = false,
    });
}

此配置构建，但是当我使用 Dropbox SSO（使用 SAML2）时，我得到了异常No Idp with entity id "Dropbox" found。

4

1 回答 1

0

您已将“Dropbox”配置为应用程序（SpOptions 中的那个）的身份（SAML2 术语中的 EntityId）。那应该是一个标识您的应用程序的 URI。约定是使用元数据的 URL (~/AuthServices)。

您需要使用保管箱 idp 的设置添加 IdentityProvider。另请注意，“Dropbox”的 EntityId 不起作用，因为 SAML2 标准要求 Entity ID 是绝对 URI。

于 2017-06-02T11:29:08.260 回答