使用STS从.Net Core调用WCF WsFederationHttpBinding服务

如何解决使用STS从.Net Core调用WCF WsFederationHttpBinding服务

我有一个app.config从.Net框架调用此服务，但现在我必须在核心应用程序中执行相同的操作。这是WCF客户端配置：

    <bindings>
    <ws2007FederationHttpBinding>
    <binding name="WS2007FederationHttpBinding_certificate" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647">
          <readerQuotas maxDepth="128" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647"
            maxNameTableCharCount="2147483647"/>
          <security mode="TransportWithMessageCredential">
            <message establishSecurityContext="false" negotiateServiceCredential="true">
              <claimTypeRequirements>
                <add claimType="http://docs.oasis-open.org/wsfed/authorization/200706/claims/action" isOptional="true"/>
                <add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier" isOptional="false"/>
                <add claimType="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"/>
              </claimTypeRequirements>
              <issuer address="https://some.url.com/STS/Issue.svc/trust/13/certificatemixed" binding="ws2007HttpBinding"
                bindingConfiguration="certificateMixed"/>
              <issuerMetadata address="https://some.url.com/STS/Issue.svc/mex"/>

             <!-- THIS IS THE PROBLEM PART -->
              <tokenRequestParameters>
                <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
                  <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
                    <Address>URN:MY.TEST.SERVICE</Address>
                  </EndpointReference>
                </wsp:AppliesTo>
              </tokenRequestParameters>
            </message>
          </security>
        </binding>
      </ws2007FederationHttpBinding>

      <ws2007HttpBinding>
        <binding name="certificateMixed">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="Certificate" establishSecurityContext="false"/>
          </security>
        </binding>
      </ws2007HttpBinding>
    </bindings>

    <behaviors>
      <endpointBehaviors>
        <behavior name="behaviorSECertificate">
          <clientCredentials>
            <clientCertificate findValue="ab cd .. b4" storeLocation="LocalMachine" storeName="My"
              x509FindType="FindByThumbprint"/>
          </clientCredentials>
        </behavior>
      </endpointBehaviors>
    </behaviors>

相当基本的东西。所以现在我在.Net核心代码中也做同样的事情：

        var issuerBinding = new WS2007HttpBinding(SecurityMode.TransportWithMessageCredential);
        issuerBinding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;
        issuerBinding.Security.Message.EstablishSecurityContext = false;
        issuerBinding.Name = "certificateMixed";

        var prm = new WsTrustTokenParameters
        {
            IssuerBinding = issuerBinding,IssuerAddress = new EndpointAddress(_seOptions.STSEndpoint),MessageSecurityVersion = MessageSecurityVersion.WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10,EstablishSecurityContext = false,};

        prm.ClaimTypes.Add(new ClaimType() { Uri = "http://docs.oasis-open.org/wsfed/authorization/200706/claims/action",IsOptional = true });
        prm.ClaimTypes.Add(new ClaimType() { Uri = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier",IsOptional = false });
        prm.ClaimTypes.Add(new ClaimType() { Uri = "http://schemas.microsoft.com/ws/2008/06/identity/claims/role",IsOptional = true });

        var binding = new WsFederationHttpBinding(prm);
        binding.Security.Message.EstablishSecurityContext = false;
        binding.Security.Message.NegotiateServiceCredential = true;
        binding.Security.Mode = SecurityMode.TransportWithMessageCredential;
        binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;

        ChannelFactory<IMyService> factory = new ChannelFactory<IMyService>(binding,new EndpointAddress(_seOptions.MyServiceUrl));

        var cert = GetClientCertificate(); //X509Certificate2
        var x = factory.Endpoint.EndpointBehaviors[typeof(ClientCredentials)];
            ((ClientCredentials)x).ClientCertificate.Certificate = cert;            
        IMyService client = factory.CreateChannel(new EndpointAddress(_seOptions.MyServiceUrl));

所以主要问题是-如何在代码中添加tokenRequestParameters/AppliesTo部分？我认为这将是这样的：

RequestSecurityToken tk = new RequestSecurityToken() { AppliesTo = new EndpointAddress("URN:MY.TEST.SERVICE") };

但是我不知道该对象要分配给什么。

解决方法

RequestSecurityToken类不适用于.net核心，您可以在此页面上查看其支持：RequestSecurityToken Class。因此，您需要在.net core中找到它的替代品。您可以参考Overview of porting from .NET Framework to .NET Core来考虑如何从.net框架迁移到.net核心。希望我的回答对您有所帮助。