Question

我们有一个2台ADFS设施,为我们MVC在各种环境中的仪器工作顺利。我认为,它使用“被动认证”(如果仍然用于适当术语),这肯定是,如果用户不贴上标签,而是把用户重新引向我们的代理人,而一旦他们被贴上标签,他们就会把用户转回我们的MVC。

我们现在开始揭露一些有保障的网络服务,希望利用同样的认证系统。我的理解是,我想使用<代码>ws2007FederationHttpBled作为我这样做的约束力。我认为,我有我的妇联网。召集了所有这一切,但我的斗争现在围绕文档进行。

在查阅这一档案时,我看到一些显然需要改变的东西,例如<编码>entityID=”http:// localhost/Userservices>和证书。然后,有些事情,如<编码>,我没有把他们现在和如果他们需要改变。 entitiesDescriptor ID=“2b510fe8-98b8 and <ds:SignatureValue>CZe5mEu19/bDNoZrY8f6C559CJ. 。



Where can I get a better understanding on how I should be managing this file for my various environments? I have the following environments hosting these services that we ll be deploying to one way or another:


Individual developer workstations (3x for now, more later)
A shared Dev environment for people writing apps against these services but not necessarily modifying the services
QA
Staging
Production (3 different environments with different certs/domains/etc.)


As such, we have a fairly streamlined process in place managing our web.config files in the different environments using transforms and finding/replacing certain tokens, so I d like to do the same thing with this xml file. So ultimately, all I m looking for is some understanding in what changes are necessary when managing this FederationMetadata.xml file for my various environments.

My current FederationMetadata.base.xml file is below and I BELIEVE this is about right (I just need names/roles) and I just need to intelligently replace the various tokens, such as ~RootServiceUrlTokenToReplace~, in here:

<?xml version="1.0" encoding="utf-8"?>
<EntityDescriptor ID="~EntityDescriptorIdTokenToReplace~" entityID="http://~RootServiceUrlTokenToReplace~" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
      <ds:Reference URI="#~ReferenceURITokenToReplace~">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
        <ds:DigestValue>~DigestValueTokenToReplace~</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>~SignatureValueTokenToReplace~</ds:SignatureValue>
    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
      <X509Data>
        <X509Certificate>~CertificateTokenToReplace~</X509Certificate>
      </X509Data>
    </KeyInfo>
  </ds:Signature>
  <RoleDescriptor xsi:type="fed:ApplicationServiceType" protocolSupportEnumeration="http://schemas.xmlsoap.org/ws/2005/02/trust http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706">
    <KeyDescriptor use="encryption">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data>
          <X509Certificate>~CertificateTokenToReplace~</X509Certificate>
        </X509Data>
      </KeyInfo>
    </KeyDescriptor>
    <fed:ClaimTypesRequested>
      <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" />
      <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Optional="true" xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" />
    </fed:ClaimTypesRequested>
    <fed:TargetScopes>
      <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
        <Address>http://~RootServiceUrlTokenToReplace~</Address>
      </EndpointReference>
    </fed:TargetScopes>
    <fed:ApplicationServiceEndpoint>
      <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
        <Address>http://~RootServiceUrlTokenToReplace~</Address>
      </EndpointReference>
    </fed:ApplicationServiceEndpoint>
  </RoleDescriptor>
</EntityDescriptor>

Answer 1

WIF的应用程序FederationMetadata.xml与该系统提供的基于索偿的网络服务无关。

(A URL pointing to)FederationMetadata.xml is used by ADFS, to Punish Update the information to be used in a Relying Parties Trust. 例如,英国广播公司可以定期查询URL,并相应更新Relying Parties Trust information。

关于网络服务(基于或以其他方式使用)的信息,即其元数据,已作为世界可持续发展论坛文件公布。在以WCF为基础的服务中,这种服务是一种经常看上去的URL:。妇地发中心的文件常常不是实物文件,而是由妇联自动生成。

Answer 2

我已经找到了部分回答我的问题:FederationMetadata Plant能够帮助我这样做。

友情链接