WCF SAML 1.1 客户端问题

Question

这是场景：

1) WCF 客户端调用 STS，通过 RST/Issue 请求请求 SAML 令牌

2) STS 响应 RSTRC/IssueFinal 将 SAML 令牌放入响应头

3) WCF 客户端获取 SAML 令牌并调用业务 Web 服务

STS 和 Web 服务托管在基于 Java 的环境中。 1) 和 2) 工作正常，也就是说，我可以看到 STS 以预期的方式响应，并且正确设置了 SOAP 标头和正文。

现在的问题是，在收到来自 STS 的响应后，WCF 客户端向业务 Web 服务发送了一个安全上下文令牌请求，这当然失败了，我不知道如何以及为什么。

这是我的客户端 app.config：

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.serviceModel>
<bindings>
<wsFederationHttpBinding>
<binding name="RegistryServiceBinding">
  <security mode="TransportWithMessageCredential">
    <message issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv1.1"
      negotiateServiceCredential="False" establishSecurityContext="false">
      <issuer address="https://my-sts-ip/idp-ws/services/BasicSAMLIssuer"
      binding="customBinding" bindingConfiguration="STSBinding" />
    </message>
  </security>
</binding>
</wsFederationHttpBinding>

<customBinding>
<binding name="STSBinding">
  <security allowInsecureTransport="False"
    authenticationMode="UserNameOverTransport"
    requireSignatureConfirmation="false"
    messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10">
  </security>          
  <textMessageEncoding messageVersion="Soap12WSAddressing10" />
  <httpsTransport/>
</binding>    
</customBinding>
</bindings>

<client>
  <endpoint address="https://my-ws-ip/soap/RegistryStoredQuery"
  binding="wsFederationHttpBinding" bindingConfiguration="RegistryServiceBinding"
  contract="IXDSRegistry" name="RegistrySTS" />
</client>
</system.serviceModel>
<startup>
  <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0,Profile=Client" />
</startup>
</configuration>

这是 WCF 客户端从 STS（缩写）获取 SAML 令牌后发送的内容：

<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
            xmlns:a="http://www.w3.org/2005/08/addressing" 
            xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<a:Action
  s:mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT</a:Action>
<a:MessageID>urn:uuid:fecde50b-a3bd-40f1-ae5b-662a3aa9bf80</a:MessageID>
<ActivityId CorrelationId="cec77c8d-1d09-4e34-9c5a-dbf5bb219ba8"
  xmlns="http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics">bfce2552-393d-43d0-8722-0c16ae22bba4</ActivityId>
<a:ReplyTo>
  <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
</a:ReplyTo>
<a:To s:mustUnderstand="1">https://10.11.71.151/soap/RegistryStoredQuery</a:To>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="_0">
  <u:Created>2011-10-28T07:27:50.097Z</u:Created>
  <u:Expires>2011-10-28T07:32:50.097Z</u:Expires>
</u:Timestamp>
<Assertion> .... </Assertion>

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
...
</Signature>
</o:Security>
</s:Header>
<s:Body>
  <t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust">
  <t:TokenType>http://schemas.xmlsoap.org/ws/2005/02/sc/sct</t:TokenType>
  <t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType>
  <t:Entropy>
    <t:BinarySecret u:Id="uuid-d1ed3eb6-d7f6-4d2b-ab7e-a6c60d899bad-3" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce">iRqJf4/sY1yiu7Vh1eTGeAWJi7o0gxnhS6A2YvJQ6kI=</t:BinarySecret>
  </t:Entropy>
<t:KeySize>256</t:KeySize>
</t:RequestSecurityToken>
</s:Body>
</s:Envelope>

有什么想法可以触发这种行为吗？

最好的问候。

Answer 1

wsFederationHttpBinding 默认将安全会话设置为 true。 You'll need to clone a custom binding and set this to false.