wcf - Windows Identity Foundation での暗号化の無効化

Question

リクエスト セキュリティ トークン レスポンスの暗号化を無効にして、署名のみを管理することはできますか?

WIF SDK のデモに基づいて Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService を拡張するカスタム STS を作成していますが、暗号化を使用しないとセットアップできません。

Answer 1

CustomSecurityHandler を作成し、次の行のように null 値を返す GetEncryptingCredentials メソッドをオーバーライドすると、機能します。

 public class MyCustomSecurityTokenHandler : Saml11SecurityTokenHandler
 {

    public MyCustomSecurityTokenHandler(): base() {}

    protected override EncryptingCredentials GetEncryptingCredentials(SecurityTokenDescriptor tokenDescriptor)
    {
        return null;
    }

 }

次に、SecurityTokenService クラスで、前に作成したカスタム クラスを返す GetSecurityTokenHandler をオーバーライドします。

protected override SecurityTokenHandler GetSecurityTokenHandler(string requestedTokenType)
    {
        MyCustomSecurityTokenHandler tokenHandler = new MyCustomSecurityTokenHandler();

        return tokenHandler;
    }

Answer 2

Visual Studio で [Add STS Reference] ウィザードを実行し、新しい STS を作成するオプションを選択しました。ツールが生成したテンプレートはトークン暗号化のサポートを追加しますが、証明書が提供されない場合は無効になります: (すべてのデフォルト コメントを残しました)

protected override Scope GetScope( IClaimsPrincipal principal, RequestSecurityToken request )
{
    ValidateAppliesTo( request.AppliesTo );

    //
    // Note: The signing certificate used by default has a Distinguished name of "CN=STSTestCert",
    // and is located in the Personal certificate store of the Local Computer. Before going into production,
    // ensure that you change this certificate to a valid CA-issued certificate as appropriate.
    //
    Scope scope = new Scope( request.AppliesTo.Uri.OriginalString, SecurityTokenServiceConfiguration.SigningCredentials );

    string encryptingCertificateName = WebConfigurationManager.AppSettings[ "EncryptingCertificateName" ];
    if ( !string.IsNullOrEmpty( encryptingCertificateName ) )
    {
        // Important note on setting the encrypting credentials.
        // In a production deployment, you would need to select a certificate that is specific to the RP that is requesting the token.
        // You can examine the 'request' to obtain information to determine the certificate to use.
        scope.EncryptingCredentials = new X509EncryptingCredentials( CertificateUtil.GetCertificate( StoreName.My, StoreLocation.LocalMachine, encryptingCertificateName ) );
    }
    else
    {
        // If there is no encryption certificate specified, the STS will not perform encryption.
        // This will succeed for tokens that are created without keys (BearerTokens) or asymmetric keys.  
        scope.TokenEncryptionRequired = false;            
    }

    // Set the ReplyTo address for the WS-Federation passive protocol (wreply). This is the address to which responses will be directed. 
    // In this template, we have chosen to set this to the AppliesToAddress.
    scope.ReplyToAddress = scope.AppliesToAddress;

    return scope;
}