0

我正在尝试向我的 STS 发出问题请求，但我不断收到以下异常：

System.ServiceModel.Security.SecurityNegotiationException' occurred in mscorlib.dll but was not handled in user code

Additional information: Could not establish secure channel for SSL/TLS with authority 'service-location-url-here'.

下面的代码在一个 asp.net 网站上运行，该网站正在模拟我自己的用户帐户。STS 服务需要相互身份验证，因此我需要使用我的安全令牌请求发送证书。服务器日志抱怨消息没有附加证书，因此中止了操作。

我在哪里失败了？

public class StsRequestWrapper
{
  public System.IdentityModel.Tokens.SecurityToken RequestSecurityToken()
  {
      IgnoreCertificateValidation();

      StsRequestUtil util = new StsRequestUtil();
      var certificate = util.GetLocalCertificate();
      var securityTokenElement = util.BuildSampleSecurityTokenElement();
      var trustChannelFactory = GetTrustChannelFactory(certificate);

      try
      {
          RequestSecurityToken rst = CreateSecurityTokenObject(securityTokenElement);
          WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();
          RequestSecurityTokenResponse rstr = null;
          return channel.Issue(rst, out rstr);
      }
      finally
      {
          trustChannelFactory.Close();
      }
  }

  private RequestSecurityToken CreateSecurityTokenObject(SecurityTokenElement securityToken)
  {
      RequestSecurityToken rst = new RequestSecurityToken()
      {
          AppliesTo = new EndpointAddress(new Uri(STS_CONSTANTS.APPLIES_TO_URL)),
          ActAs = securityToken,
          RequestType = RequestTypes.Issue,
          Lifetime = new Lifetime(DateTime.UtcNow, DateTime.UtcNow.AddMinutes(5)),
      };

      var requestClaim = new RequestClaim(STS_CONSTANTS.REQUEST_CLAIM_TYPE, false, STS_CONSTANTS.REQUEST_CLAIM_VALUE);
      rst.Claims.Dialect = STS_CONSTANTS.CLAIMS_DIALECT;
      rst.Claims.Add(requestClaim);
      return rst;
  }

  private WSTrustChannelFactory GetTrustChannelFactory(X509Certificate2 localhostCertificate)
  {

      WS2007HttpBinding binding = new WS2007HttpBinding();
      binding.Security.Mode = SecurityMode.Transport;
      binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;

      var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(new Uri(STS_CONSTANTS.STS_URL)));
      trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;

      trustChannelFactory.Credentials.ClientCertificate.Certificate = localhostCertificate;
      trustChannelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust;
      trustChannelFactory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;

      return trustChannelFactory;
  }

  private static void IgnoreCertificateValidation()
  {
      System.Net.ServicePointManager.ServerCertificateValidationCallback = ((sender, certificate, chain, sslPolicyErrors) => true);
  }

}

4

1 回答 1

0

事实证明，我需要使用 CertificateWSTrustBinding 而不是 WS2007HttpBinding。

        var binding = new CertificateWSTrustBinding();
        binding.SecurityMode = SecurityMode.Transport;
于 2011-01-21T00:49:05.153 回答