Databases
StackOverflow2013
Postsdbo
PO
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    text
    copied!<p>I don't think you can. In your situation though, you should only have the one WIF endpoint have leave the multiple credential support to the STS. </p> <p>You can put multiple endpoints on your STS to handle different types of authentication. One for Windows, one for username/password for example.</p> <p>I did a code camp oz session last year that demonstrated this. The source is attached to my blog post at <a href="http://www.neovolve.com/post/2010/11/21/CodeCampOz-Not-a-WIF-of-federation.aspx" rel="nofollow">http://www.neovolve.com/post/2010/11/21/CodeCampOz-Not-a-WIF-of-federation.aspx</a>. Have a look at the web.config in <em>NotAWif Demo\4 - Identity Delegation\NotAWif.DelegationSTS</em>.</p> <pre><code>&lt;system.serviceModel&gt; &lt;services&gt; &lt;service behaviorConfiguration="ServiceBehavior" name="Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract"&gt; &lt;endpoint address="UserName/IWSTrust13" binding="ws2007HttpBinding" bindingConfiguration="ws2007HttpBindingUserNameConfiguration" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrust13SyncContract" /&gt; &lt;endpoint address="Windows/IWSTrust13" binding="ws2007HttpBinding" bindingConfiguration="ws2007HttpBindingWindowsConfiguration" contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrust13SyncContract" /&gt; &lt;endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" /&gt; &lt;host&gt; &lt;baseAddresses&gt; &lt;add baseAddress="https://localhost/NotAWif.DelegationSTS/Service.svc" /&gt; &lt;/baseAddresses&gt; &lt;/host&gt; &lt;/service&gt; &lt;/services&gt; &lt;bindings&gt; &lt;ws2007HttpBinding&gt; &lt;binding name="ws2007HttpBindingUserNameConfiguration"&gt; &lt;security mode="TransportWithMessageCredential"&gt; &lt;transport clientCredentialType="None"&gt; &lt;extendedProtectionPolicy policyEnforcement="Never" /&gt; &lt;/transport&gt; &lt;message clientCredentialType="UserName" establishSecurityContext="false" /&gt; &lt;/security&gt; &lt;/binding&gt; &lt;binding name="ws2007HttpBindingWindowsConfiguration"&gt; &lt;security mode="TransportWithMessageCredential"&gt; &lt;transport clientCredentialType="None"&gt; &lt;extendedProtectionPolicy policyEnforcement="Never" /&gt; &lt;/transport&gt; &lt;message clientCredentialType="Windows" establishSecurityContext="false" /&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/ws2007HttpBinding&gt; &lt;/bindings&gt; &lt;behaviors&gt; &lt;serviceBehaviors&gt; &lt;behavior name="ServiceBehavior"&gt; &lt;serviceMetadata httpGetEnabled="true" /&gt; &lt;serviceDebug includeExceptionDetailInFaults="false" /&gt; &lt;serviceCredentials&gt; &lt;serviceCertificate findValue="DefaultApplicationCertificate" x509FindType="FindBySubjectName" /&gt; &lt;/serviceCredentials&gt; &lt;/behavior&gt; &lt;/serviceBehaviors&gt; &lt;/behaviors&gt; &lt;/system.serviceModel&gt; </code></pre> <p>This is how I configured the STS to support multiple types of authentication. The RP should only deal in claims, not claims|WindowsIdentity. It is the STS's responsibility to convert a particular type of authentication into a set of claims that the RP will use.</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload