0

I have a service that is setup to retrieve a secure token from ADFS and use that token to communicate with other services. When I contact my ADFS windowsmixed endpoint from my local development machine hitting the ADFS service I am able to successfuly retrieve the token. However, when I install my service on the same machine that is running ADFS I receive the following error:

 Secure channel cannot be opened because security negotiation with the remote endpoint has failed. This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint.

I am able to reproduce the error with the following code that simply gets the token. Again this code works when I am on my dev machine hitting the remote server, but it fails when on the server directly. I am using the same user credentials on both. I get the same error within the IIS web service using the app pool credentials and with a simple test client using the code below.

    private static SecurityToken GetToken()
    {
        string stsEndpoint = "https://adfsserver.com/adfs/services/trust/13/windowsmixed";
         string appliesTo = "http://domain.com/application/myapplication";

        var factory = new WSTrustChannelFactory(
            new WindowsWSTrustBinding(SecurityMode.TransportWithMessageCredential),
            stsEndpoint);
        factory.TrustVersion = TrustVersion.WSTrust13;

        var rst = new RequestSecurityToken
        {
            RequestType = RequestTypes.Issue,
            AppliesTo = new EndpointAddress(appliesTo),
            KeyType = KeyTypes.Symmetric
        };

        var channel = factory.CreateChannel();
        return channel.Issue(rst);
    }

I turned on tracing in the Windows Event Log for ADFS 2.0 debug. When hitting that windowsmixed endpoint directly on the server, I do not receive any entries which leads me to belive that it is not actually getting to the endpoint.

I do receive quite a few audit failures in the security log that are related to the services that I am running: A handle to an object was requested.

Subject:
    Security ID:        DOMAIN\ODI$ODIController
    Account Name:       ODI$ODIController
    Account Domain:     DOMAIN
    Logon ID:       0x1a574b5

Object:
    Object Server:      SC Manager
    Object Type:        SERVICE OBJECT
    Object Name:        WinHttpAutoProxySvc
    Handle ID:      0x0

Process Information:
    Process ID:     0x1f8
    Process Name:       C:\Windows\System32\services.exe

Access Request Information:
    Transaction ID:     {00000000-0000-0000-0000-000000000000}
    Accesses:       Query status of service
                Start the service
                Query information from service

    Access Reasons:     -
    Access Mask:        0x94
    Privileges Used for Access Check:   -

I am able to access the usernamemixed endpoint using stored credentials and receive the proper token, so it seems to be something with authenticating the user to even be able to communicate with the ADFS endpoint.

If I set specific credentials in the code above, it is able to connect. Which again leads me to believe that it is not passing the correct credentials for my Windows user when on the same machine.

 factory.Credentials.Windows.ClientCredential = new System.Net.NetworkCredential("UserID", "password1", "dev.domain");

Thank you for any assistance you can provide.

Brian

4

1 に答える 1

1

同様の問題がありました。ここの例を使用して動作させることができました：http：//blogs.southworks.net/mwoloski/2009/07/17/getting-a-token-from-adfs-ex-geneva-server-using-wcf //

コードと実際の例の違いは、クライアントではなくバインディングで現在のセキュリティクレデンシャルを使用するようにメッセージセキュリティを変更することです。WIF 4.0を使用している場合は、WSTrustClientの代わりにWSTrustChannelFactoryを使用するようにコードを変更する必要があります。ただし、他のコードはあまり変更されていません。

ファクトリの私のコードは次のようになります。

var binding = new WS2007HttpBinding(SecurityMode.TransportWithMessageCredential); binding.Security.Message.ClientCredentialType = MessageCredentialType.Windows; binding.Security.Message.EstablishSecurityContext = false;

var factory = new WSTrustChannelFactory( binding, new EndpointAddress(new Uri(sts), EndpointIdentity.CreateUpnIdentity(adfsUpn)));

于 2012-03-27T20:04:48.330 に答える