0

有这样的问题

我们已声明为该站点配置了感知的 asp.net 站点和 adfs 服务器

所以，我们已经 - 我们启动了我们的 Web 应用程序 - 移动到 adfs 服务器进行身份验证并返回到网站 - 结果我们有错误的服务器页面，其中包含我们网站的 url

**System.NotSupportedException: The private key does not support the exchange KeySpec.
Source Error: 
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  
Stack Trace: 
[NotSupportedException: The private key does not support the exchange KeySpec.]
   System.IdentityModel.Tokens.X509AsymmetricSecurityKey.DecryptKey(String algorithm, Byte[] keyData) +237615
   System.IdentityModel.Selectors.SimpleTokenResolver.TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, SecurityKey& key) +378
   Microsoft.IdentityModel.Tokens.EncryptedSecurityTokenHandler.ReadToken(XmlReader reader) +253
   Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader) +105
   Microsoft.IdentityModel.Web.TokenReceiver.ReadToken(String tokenXml, XmlDictionaryReaderQuotas readerQuotas) +282
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request) +312
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +1099462
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +171**

Windows 日志显示，此时我们收到这样的警告 - 正如我建议的与服务器错误页面中的错误完全相关

Log Name:      Application
Source:        ASP.NET 2.0.50727.0
Date:          3/23/2011 2:05:50 PM
Event ID:      1309
Task Category: Web Event
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      machine-name
Description:
Event code: 3005 
Event message: An unhandled exception has occurred. 
Event time: 3/23/2011 2:05:50 PM 
Event time (UTC): 3/23/2011 2:05:50 PM 
Event ID: 356af0be20744d15bba97111f6bbd475 
Event sequence: 7 
Event occurrence: 6 
Event detail code: 0 

Application information: 
    Application domain: /appl-domain/ClaimsAwareWebAppWithManagedSTS-1-129453622903756000 
    Trust level: Full 
    Application Virtual Path: /ClaimsAwareWebAppWithManagedSTS 
    Application Path: C:\tools\AdvantageSso\Using Managed STS\ClaimsAwareWebAppWithManagedSTS\ 
    Machine name: machine-name 

Process information: 
    Process ID: 3840 
    Process name: w3wp.exe 
    Account name: NT AUTHORITY\NETWORK SERVICE 

Exception information: 
    Exception type: NotSupportedException 
    Exception message: The private key does not support the exchange KeySpec. 

Request information: 
    Request URL: https://app-url/ClaimsAwareWebAppWithManagedSTS/default.aspx 
    Request path: /ClaimsAwareWebAppWithManagedSTS/default.aspx 
    User host address: host-name
    User:  
    Is authenticated: False 
    Authentication Type:  
    Thread account name: NT AUTHORITY\NETWORK SERVICE 

Thread information: 
    Thread ID: 10 
    Thread account name: NT AUTHORITY\NETWORK SERVICE 
    Is impersonating: False 
    Stack trace:    at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.DecryptKey(String algorithm, Byte[] keyData)
   at System.IdentityModel.Selectors.SecurityTokenResolver.SimpleTokenResolver.TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, SecurityKey& key)
   at Microsoft.IdentityModel.Tokens.EncryptedSecurityTokenHandler.ReadToken(XmlReader reader)
   at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader)
   at Microsoft.IdentityModel.Web.TokenReceiver.ReadToken(String tokenXml, XmlDictionaryReaderQuotas readerQuotas)
   at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)
   at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
   at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

带有空用户和 IsAuthenticated = false 的部分非常混乱......这是否意味着我们没有通过 ADFS 身份验证或者它显示请求站点的当前结果

所以，不幸的是，我不是这方面的专家，并且在本周与它作斗争

有人可以帮我解决问题吗？

非常感谢

4

2 回答 2

1

这里似乎发生的是，您在 AD FS 中的信赖方信任被配置为使用某些证书（的公共部分）加密其令牌。它会这样做，并且您的 Web 应用程序会尝试使用同一证书的私钥对它们进行解密。

但是，证书需要支持“密钥交换”，从您的错误消息来看，您的似乎不支持。我不知道您从哪里获得证书，但如果您使用IX509Enrollment通过 Windows COM 以编程方式创建它，那么您需要将IX509PrivateKey的KeySpec设置为XCN_AT_KEYEXCHANGE。

您需要做的另一件事是确保证书支持“文档签名”。为此，请确保IX509ExtensionEnhancedKeyUsage包含 XCN_OID_KP_DOCUMENT_SIGNING 或 1.3.6.1.4.1.311.10.3.12。

此外，上述 COM 接口背后的 COM 类名称记录在IX509EnrollmentWebClassFactory::CreateObject页面上。

于 2011-03-23T19:44:28.703 回答
0

您还应该检查处理证书的（服务）用户在本地计算机上是否有足够的权限来访问证书。那是我的问题。

于 2018-02-06T08:53:19.377 回答