asp.net-mvc - (Claims) セキュリティ トークンを WIF 対応の WCF サービスに渡すにはどうすればよいですか?

Question

私の望遠鏡 :

(Claims) セキュリティ トークンを WIF 対応の WCF サービスに渡すにはどうすればよいですか?

セキュリティ asp mvc を実装する (ok)

wcf にセキュリティを実装する (OK ではない)

クライアントから wcf にトークンを渡します。(OK ではありません)

私のコードクライアント

    using System.IdentityModel.Tokens;
    using System.Security.Claims;
    using System.ServiceModel;
    using System.ServiceModel.Security;
    using System.Web.Mvc;
    using Microsoft.IdentityModel.Protocols.WSTrust;
    using Nobre.Core.Helpers;
    using Wcf;


    namespace Mvc.Controllers
    {
        public class HomeController : Controller
        {
            [Authorize]
            public ActionResult Index()
            {
                var identity = HttpContext.User.Identity as ClaimsIdentity;
                var securityToken = WcfHelper.GetActAsToken(identity.BootstrapContext as BootstrapContext);
                var serviceAddress = "https://estnbr363.nobre.local/Service1.svc";
                var binding = new WSFederationHttpBinding();

                binding.Security.Mode = WSFederationHttpSecurityMode.TransportWithMessageCredential;
                binding.Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.Basic256Rsa15;
                binding.Security.Message.NegotiateServiceCredential = true;
                binding.Security.Message.IssuedKeyType = SecurityKeyType.SymmetricKey;
                binding.Security.Message.IssuedTokenType ="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv1.1";

                var factory = new ChannelFactory<IService1>(binding, serviceAddress);
                factory.ConfigureChannelFactory();
                factory.Credentials.SupportInteractive = false;
                var channel = factory.CreateChannelActingAs(securityToken);  

                return View( channel.GetData(1));

            }
        }
    }


    web config service         
<?xml version="1.0"?>
<configuration>
  <configSections>
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  </configSections>
  <appSettings>
    <add key="ida:FederationMetadataLocation" value="https://nobre-security.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml" />
    <add key="ida:Issuer" value="https://nobre-security.accesscontrol.windows.net/v2/wsfederation" />
    <add key="ida:ProviderSelection" value="ACS" />
  </appSettings>
  <location path="FederationMetadata">
    <system.web>
      <!--<authorization>
        <allow users="*" />
      </authorization>-->
    </system.web>
  </location>
  <system.web>
    <!--<authorization>
      <deny users="?" />
    </authorization>-->
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" />
  </system.web>
  <system.serviceModel>
    <diagnostics>
      <messageLogging maxMessagesToLog="25000" logEntireMessage="true" logMessagesAtServiceLevel="false"  logMalformedMessages="true" logMessagesAtTransportLevel="true">
        <filters>
          <clear/>
        </filters>
      </messageLogging>
    </diagnostics>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceMetadata httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials useIdentityConfiguration="true" />
          <serviceAuthorization principalPermissionMode="Always" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
    <bindings>
      <ws2007FederationHttpBinding >
        <binding >
          <security mode="TransportWithMessageCredential">
            <message  issuedKeyType="BearerKey" negotiateServiceCredential="true">
              <issuerMetadata address="https://federation.nobre.net.br/adfs/services/trust/mex" />
            </message>
          </security>
        </binding>
      </ws2007FederationHttpBinding>
    </bindings>
    <services>
      <service name="Wcf.Service1" behaviorConfiguration="">
        <endpoint name="ws2007FederationHttpBinding.Service1" address="ws2007FederationHttpBinding" binding="ws2007FederationHttpBinding" contract="Wcf.IService1" />
      </service>    
    </services>
  </system.serviceModel>
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
    <directoryBrowse enabled="true" />
  </system.webServer>
  <system.identityModel>
    <identityConfiguration saveBootstrapContext="true">
      <audienceUris>
        <add value="https://estnbr363.nobre.local/Service1.svc" />
      </audienceUris>
      <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
        <authority name="https://nobre-security.accesscontrol.windows.net/">
          <keys>
            <add thumbprint="213D414F8E89D865FD10A49C8C8F838A9460EBEE" />
          </keys>
          <validIssuers>
            <add name="https://nobre-security.accesscontrol.windows.net/" />
          </validIssuers>
        </authority>
      </issuerNameRegistry>      
      <certificateValidation certificateValidationMode="None" />
    </identityConfiguration>
  </system.identityModel>  
</configuration>

回線エラー

channel.GetData(1);

セキュリティ トークンの発行者のアドレスが指定されていません。「 https://estnbr363.nobre.local/Service1.svc 」宛先へのリンクで明示的な発行者アドレスを指定するか、送信者のアドレスの場所を資格情報で構成する必要があります。

the problem are these lines below! how to implement ?

  // Extract the STS certificate from the certificate store. ?????????
      X509Store store = new X509Store(StoreName.TrustedPeople, StoreLocation.CurrentUser);
      store.Open(OpenFlags.ReadOnly);
      X509Certificate2Collection certs = store.Certificates.Find(
          X509FindType.FindByThumbprint, "0000000000000000000000000000000000000000", false);
      store.Close();

      // Create an EndpointIdentity from the STS certificate. ???????????
      EndpointIdentity identity = EndpointIdentity.CreateX509CertificateIdentity ( certs[0] );

      // Set the IssuerAddress using the address of the STS and the previously created ???????

      // EndpointIdentity.
      b.Security.Message.IssuerAddress = 
          new EndpointAddress(new Uri("http://localhost:8000/sts/x509"), identity);