Databases
StackOverflow2013
Postsdbo
POWCF STS Token Expiration Problem
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POWCF STS Token Expiration Problem
    text
    copied!<p>I have a WCF service (FooService) protected by Secure Conversation. Also have an STS (StsService) that provides tokens to clients calling FooService. The tokens are good for 15 minutes. The STS is custom-build (no Geneva). The client also has some custom WCF extensions to allow re-use of the token across several services during the lifetime of the client.</p> <p>The client requests a token from the STS when "Open" on the channel to FooService is called. The STS works fine, issues the token and provides a valid RSTR back to the client. The client receives the de-serialized token (as a <code>GenericXmlSecurityToken</code> object).</p> <p><strong>Problem:</strong></p> <p>When the client receives the <code>GenericXmlSecurityToken</code> instance, the expiration date is NOT set correctly. In the RSTR, there is a SAML tag <code>&lt;saml:Conditions&gt;</code> which has the valid expiration date BUT, for some reason, WCF does not seem to be parsing the tag and using the value of <code>NotOnOrAfter</code>.</p> <p>Here is the binding for the STS (server-side):</p> <pre><code> &lt;binding name="stsBinding" receiveTimeout="infinite" sendTimeout="infinite"&gt; &lt;security authenticationMode="SecureConversation" requireSecurityContextCancellation="true"&gt; &lt;localClientSettings maxClockSkew="23:59:59" /&gt; &lt;localServiceSettings maxClockSkew="23:59:59" inactivityTimeout="00:02:00" /&gt; &lt;secureConversationBootstrap authenticationMode="UserNameForSslNegotiated"&gt; &lt;localClientSettings maxClockSkew="23:59:59" /&gt; &lt;localServiceSettings maxClockSkew="23:59:59" /&gt; &lt;/secureConversationBootstrap&gt; &lt;/security&gt; &lt;binaryMessageEncoding /&gt; </code></pre> <p>Here is the client-side binding:</p> <pre><code>&lt;binding name="stsBinding" closeTimeout="00:02:00" openTimeout="00:02:00" sendTimeout="00:02:00"&gt; &lt;security authenticationMode="SecureConversation" requireSecurityContextCancellation="true"&gt; &lt;localClientSettings maxClockSkew="23:59:59" /&gt; &lt;localServiceSettings maxClockSkew="23:59:59" inactivityTimeout="00:02:00" /&gt; &lt;secureConversationBootstrap authenticationMode="UserNameForSslNegotiated"&gt; &lt;localClientSettings maxClockSkew="23:59:59" /&gt; &lt;localServiceSettings maxClockSkew="23:59:59" /&gt; &lt;/secureConversationBootstrap&gt; &lt;/security&gt; &lt;binaryMessageEncoding /&gt; &lt;tcpTransport maxReceivedMessageSize="2097152" maxBufferSize="2097152" maxPendingConnections="10" listenBacklog="10" /&gt; &lt;/binding&gt; </code></pre> <p>I have tried several things to get the correct expiration date to show-up... but nothings seems to work. Tried implementing a custom Serializer. Could not find any trace of <code>&lt;saml:Conditions&gt;</code>. Also tried calling the STS directly, then providing the token back to WCF. That solution worked, calling the STS directly and de-serializing the response into a valid SecurityToken, but when it is provided back to WCF, the "Open" call on the channel times-out after 2 mintues. No error message, nothing in the trace log...</p> <p>On the client-side, the token has the SAML assertion. If I look at: <code>((GenericXmlSecurityToken)token).TokenXml.InnerXml</code>, this is what I see:</p> <pre><code>&lt;saml:Conditions NotBefore="2009-09-01T19:36:54.669Z" NotOnOrAfter="2009-09-01T19:41:54.669Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"&gt; &lt;/saml:Conditions&gt; </code></pre> <p>Even tried stepping through the .NET Framework source, but cannot do that with VS 2008 SP1 on Windows 7. DOES NOT WORK! Arg!</p> <p>Any ideas?</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload