Databases
StackOverflow2013
Postsdbo
POHow to process saml:Assertion in WCF?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to process saml:Assertion in WCF?
    primarykey
    data
    text
    <p>New to WCF, but very familiar with past WSE* paradigms. I'm finding the configurability (read: complexities) of WCF to be quite a challenge.</p> <p>I'm attempting to use a .NET 4.0 WCF Client to consume a web service provided by our government which runs on WebSphere Application Server/6.1.</p> <p>Their scheme uses a UsernameToken to authenticate and exchange for a SAML Assertion over HTTPS transport encryption. This SAML Assertion is used for the remainder of the opertations with their services.</p> <p>When attempting to "Login" (i.e. acquire the SAML Assertion), I'm getting the following exception from WCF when it attempts to process the return SOAP:</p> <p><strong>"Cannot find a token authenticator for the 'System.IdentityModel.Tokens.SamlSecurityToken' token type. Tokens of that type cannot be accepted according to current security settings."</strong></p> <p>Here's my settings file:</p> <pre><code>&lt;system.serviceModel&gt; &lt;client&gt; &lt;endpoint binding="basicHttpBinding" bindingConfiguration="Default" contract="ServiceProxy.Login" name="Login" /&gt; &lt;/client&gt; &lt;bindings&gt; &lt;basicHttpBinding&gt; &lt;binding name="Default"&gt; &lt;security mode="TransportWithMessageCredential"&gt; &lt;transport clientCredentialType="None"/&gt; &lt;message clientCredentialType="UserName" /&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/basicHttpBinding&gt; &lt;/bindings&gt; &lt;/system.serviceModel&gt; </code></pre> <p>Here's the SOAP request:</p> <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt; &lt;s:Header&gt; &lt;!-- Removed --&gt; &lt;ActivityId CorrelationId="c9363270-1b33-4ffe-90b0-427feebcebf6" xmlns="http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics"&gt;cadd6a3c-7b36-46eb-9130-390227effc08&lt;/ActivityId&gt; &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt; &lt;u:Timestamp u:Id="_0"&gt; &lt;u:Created&gt;2012-12-13T22:50:22.308Z&lt;/u:Created&gt; &lt;u:Expires&gt;2012-12-13T22:55:22.308Z&lt;/u:Expires&gt; &lt;/u:Timestamp&gt; &lt;o:UsernameToken u:Id="uuid-91607d82-da2c-4004-93b6-baf5973ba057-1"&gt; &lt;o:Username&gt; &lt;!-- Removed--&gt; &lt;/o:Username&gt; &lt;o:Password&gt; &lt;!-- Removed--&gt; &lt;/o:Password&gt; &lt;/o:UsernameToken&gt; &lt;/o:Security&gt; &lt;/s:Header&gt; &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt; &lt;LoginRequest xmlns="http://snipped.url/Services.xsd"&gt;&lt;/LoginRequest&gt; &lt;/s:Body&gt; &lt;/s:Envelope&gt; </code></pre> <p>And here's the response that makes WCF choke:</p> <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt; &lt;soapenv:Header&gt; &lt;!-- Removed --&gt; &lt;o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:mustUnderstand="1"&gt; &lt;saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" AssertionID="id-94ef81a2eba3b246e284f72c3313e32ababe9482" IssueInstant="2012-12-13T22:50:23.930Z" Issuer="http://www.forumsys.com/sentry" MajorVersion="1" MinorVersion="1"&gt; &lt;saml:Conditions NotBefore="2012-12-13T22:50:23.930Z" NotOnOrAfter="2012-12-14T08:50:23.930Z"&gt;&lt;/saml:Conditions&gt; &lt;saml:AuthenticationStatement AuthenticationInstant="2012-12-13T22:50:23.930Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password"&gt; &lt;saml:Subject&gt; &lt;saml:NameIdentifier&gt; &lt;!-- Removed--&gt; &lt;/saml:NameIdentifier&gt; &lt;saml:SubjectConfirmation&gt; &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:sender-vouches&lt;/saml:ConfirmationMethod&gt; &lt;/saml:SubjectConfirmation&gt; &lt;/saml:Subject&gt; &lt;saml:SubjectLocality&gt; &lt;!-- Removed--&gt; &lt;/saml:SubjectLocality&gt; &lt;/saml:AuthenticationStatement&gt; &lt;saml:AttributeStatement&gt; &lt;saml:Subject&gt; &lt;saml:NameIdentifier&gt; &lt;!-- Removed--&gt; &lt;/saml:NameIdentifier&gt; &lt;saml:SubjectConfirmation&gt; &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:sender-vouches&lt;/saml:ConfirmationMethod&gt; &lt;/saml:SubjectConfirmation&gt; &lt;/saml:Subject&gt; &lt;saml:Attribute AttributeName="SMSESSION" AttributeNamespace="http://www.forumsys.com/sentry"&gt; &lt;saml:AttributeValue&gt; &lt;!-- Removed--&gt; &lt;/saml:AttributeValue&gt; &lt;/saml:Attribute&gt; &lt;/saml:AttributeStatement&gt; &lt;/saml:Assertion&gt; &lt;u:Timestamp xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" u:Id="_0"&gt; &lt;u:Created&gt;2012-12-13T22:50:22.308Z&lt;/u:Created&gt; &lt;u:Expires&gt;2012-12-13T22:55:22.308Z&lt;/u:Expires&gt; &lt;/u:Timestamp&gt; &lt;o:UsernameToken xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" u:Id="uuid-91607d82-da2c-4004-93b6-baf5973ba057-1"&gt; &lt;o:Username&gt; &lt;!-- Removed--&gt; &lt;/o:Username&gt; &lt;o:Password&gt; &lt;!-- Removed--&gt; &lt;/o:Password&gt; &lt;/o:UsernameToken&gt; &lt;/o:Security&gt; &lt;/soapenv:Header&gt; &lt;soapenv:Body&gt; &lt;wn1:LoginResponse xmlns:wn1="http://snipped.url/Services.xsd"&gt; &lt;wn1:Status&gt;session counter updated&lt;/wn1:Status&gt; &lt;/wn1:LoginResponse&gt; &lt;/soapenv:Body&gt; &lt;/soapenv:Envelope&gt; </code></pre> <p>The above response is a successful response and matches prior versions running on WSE2/3 (which for other reasons I'm unable to use going forward).</p> <p>How do I get WCF to acknowledge the above response as valid? Or perhaps just to get it to ignore the fact that it can't parse it and I can manually parse it perhaps.</p> <p>I'm stumped!</p> <p><strong>UPDATE #1:</strong></p> <p>I started to go down the Custom Client credentials route. This seemed promising, if a bit complicated. </p> <p>If you want to go this route...</p> <p>1) See MS article series here: <a href="http://msdn.microsoft.com/en-us/library/ms730868(v=vs.100).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/ms730868(v=vs.100).aspx</a></p> <p>2) Also see WCF Samples WCF\Extensibility\Security\SamlTokenProvider.</p> <p>3) Blog post using this method: <a href="http://bronumski.blogspot.com/2011/11/this-has-been-hanging-around-in-my.html" rel="nofollow">http://bronumski.blogspot.com/2011/11/this-has-been-hanging-around-in-my.html</a></p> <p>This should allow you to use SAML Assertions without WIF.</p> <p><strong>UPDATE #2:</strong></p> <p>See my answer and ultimate solution below.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USwes
    1. USwes
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COYou should add your solution as an answer, so that you can get upvotes, and so that future readers can find it more easily.
      singulars
      1. POHow to process saml:Assertion in WCF?
      1. USJohn Saunders
    2. COHmmm. Technically Yaron gave the answer, which I accepted, I just detailed the final solution in my OP. If I do what you suggest, wouldn't that apply the points to me instead of Yaron? (Not very familiar with how SO does that)
      singulars
      1. POHow to process saml:Assertion in WCF?
      1. USwes
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload