Databases
StackOverflow2013
Postsdbo
POUsing tokens assigned from an STS to call a WCF service
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POUsing tokens assigned from an STS to call a WCF service
    primarykey
    data
    text
    <p>I've been staring at this all day to no avail and I'm out of ideas. The IP-STS handles the login then passes it down to the RP-STS which fills the token with claims and then onto the Website. this works correctly. I have some WCF functions on the IP-STS such as change password/reset password and need to access them. Having read around I <em>should</em> be able to send the token already assigned through to the WCF to ensure the user is authenticated. From what I can see it is sending the token but not correctly and also not in the way that I want as it seems to need a username at the moment.</p> <p><strong>Ideally</strong> I want it to take the token assigned to the user and not have to re-request or re-create anything and definatly not any need for username/password.</p> <p><strong>The error I am currently getting is:</strong> An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail.</p> <p><strong>Detail:</strong> The message could not be processed. This is most likely because the action 'http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue' is incorrect or because the message contains an invalid or expired security context token or because there is a mismatch between bindings. The security context token would be invalid if the service aborted the channel due to inactivity. To prevent the service from aborting idle sessions prematurely increase the Receive timeout on the service endpoint's binding.</p> <p>Here is the relevant bits from my web configs.</p> <p>client side web.config</p> <hr> <pre><code>&lt;system.serviceModel&gt; &lt;bindings&gt; &lt;customBinding&gt; &lt;binding name="UsernameBinding"&gt; &lt;security authenticationMode="UserNameForCertificate" requireSecurityContextCancellation ="false" requireSignatureConfirmation="false" messageProtectionOrder ="SignBeforeEncryptAndEncryptSignature" requireDerivedKeys="true"&gt; &lt;/security&gt; &lt;httpTransport/&gt; &lt;/binding&gt; &lt;/customBinding&gt; &lt;wsFederationHttpBinding&gt; &lt;binding name="HTTPEndpoint" closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"&gt; &lt;security mode="Message"&gt; &lt;message issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" negotiateServiceCredential="false"&gt; &lt;claimTypeRequirements&gt; &lt;add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="false" /&gt; &lt;/claimTypeRequirements&gt; &lt;issuer address="http://localhost:13422/MembershipService" bindingConfiguration="UsernameBinding" binding="customBinding"&gt; &lt;identity&gt; &lt;certificateReference findValue="STSTestCert" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="TrustedPeople" /&gt; &lt;/identity&gt; &lt;/issuer&gt; &lt;/message&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/wsFederationHttpBinding&gt; &lt;/bindings&gt; &lt;behaviors&gt; &lt;!-- Credentials configuration --&gt; &lt;endpointBehaviors&gt; &lt;behavior name="ServiceBehavior"&gt; &lt;clientCredentials&gt; &lt;clientCertificate findValue="STSTestCert" storeLocation="CurrentUser" storeName="TrustedPeople" x509FindType="FindBySubjectName" /&gt; &lt;serviceCertificate&gt; &lt;defaultCertificate findValue="STSTestCert" storeLocation="CurrentUser" storeName="TrustedPeople" x509FindType="FindBySubjectName"/&gt; &lt;authentication certificateValidationMode="PeerOrChainTrust" /&gt; &lt;/serviceCertificate&gt; &lt;/clientCredentials&gt; &lt;/behavior&gt; &lt;/endpointBehaviors&gt; &lt;/behaviors&gt; &lt;client&gt; &lt;endpoint address="http://localhost:13422/MembershipService" binding="wsFederationHttpBinding" bindingConfiguration="HTTPEndpoint" contract="MembershipService.IAccountMembershipService" name="HTTPEndpoint" behaviorConfiguration="ServiceBehavior"&gt; &lt;identity&gt; &lt;dns value="localhost"/&gt; &lt;/identity&gt; &lt;/endpoint&gt; &lt;/client&gt; </code></pre> <p></p> <hr> <p>Service side:</p> <pre><code>&lt;system.serviceModel&gt; &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true"&gt; &lt;serviceActivations&gt; &lt;add relativeAddress="IAccountMembershipService.svc" service="AccountMembershipService" factory="System.ServiceModel.Activation.WebServiceHostFactory" /&gt; &lt;/serviceActivations&gt; &lt;/serviceHostingEnvironment&gt; &lt;bindings&gt; &lt;wsHttpBinding&gt; &lt;binding name="federationBinding" receiveTimeout="00:10:00" sendTimeout="00:10:00" closeTimeout="00:10:00" openTimeout="00:10:00"&gt; &lt;security mode="Message"&gt; &lt;message negotiateServiceCredential="true" /&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/wsHttpBinding&gt; &lt;wsFederationHttpBinding&gt; &lt;binding name="federationBinding" closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"&gt; &lt;security mode="Message"&gt; &lt;message issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" negotiateServiceCredential="false"&gt; &lt;claimTypeRequirements&gt; &lt;add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="false" /&gt; &lt;/claimTypeRequirements&gt; &lt;issuer address="http://localhost:13422/MembershipService" bindingConfiguration="UsernameBinding" binding="customBinding"&gt; &lt;identity&gt; &lt;certificateReference findValue="STSTestCert" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="TrustedPeople" /&gt; &lt;/identity&gt; &lt;/issuer&gt; &lt;/message&gt; &lt;/security&gt; &lt;/binding&gt; &lt;/wsFederationHttpBinding&gt; &lt;/bindings&gt; &lt;behaviors&gt; &lt;serviceBehaviors&gt; &lt;behavior name="serviceBehavior"&gt; &lt;serviceMetadata httpGetEnabled="true" /&gt; &lt;serviceCredentials&gt; &lt;serviceCertificate findValue="CN=STSTestCert" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName"/&gt; &lt;/serviceCredentials&gt; &lt;/behavior&gt; &lt;/serviceBehaviors&gt; &lt;/behaviors&gt; &lt;extensions&gt; &lt;behaviorExtensions&gt; &lt;!-- This behavior extension will enable the service host to be Claims aware --&gt; &lt;add name="federatedServiceHostConfiguration" type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=0.6.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/&gt; &lt;/behaviorExtensions&gt; &lt;/extensions&gt; &lt;services&gt; &lt;service behaviorConfiguration="serviceBehavior" name="STS.IP.Models.AccountMembershipService"&gt; &lt;endpoint binding="wsFederationHttpBinding" bindingConfiguration="federationBinding" name="HTTPEndpoint" contract="STS.IP.Infrastructure.IAccountMembershipService" &gt; &lt;identity&gt; &lt;dns value="localhost"/&gt; &lt;/identity&gt; &lt;/endpoint&gt; &lt;!-- &lt;endpoint binding="wsHttpBinding" bindingConfiguration="" name="HTTPEndpoint" contract="Aurora.WCFIsAlive.IIsAlive" /&gt;--&gt; &lt;/service&gt; &lt;/services&gt; </code></pre> <p></p> <p>Sorry for the massive pastes but hopefully someone can spot my error! Am I just approaching it the wrong way?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USHenry
    1. USHenry
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POUsing tokens assigned from an STS to call a WCF service
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POUsing tokens assigned from an STS to call a WCF service
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POUsing tokens assigned from an STS to call a WCF service
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload