c# - 使用 Windows 直通身份验证检索依赖方信任的 SAML 令牌

Question

我正在尝试确定一种应用程序检索 SAML 令牌以代表应用程序的当前上下文（作为用户）访问依赖方信任的方法。

常见的建议是使用 WSTrustChannelFactory 但提供用户名和密码来检索 SAML 令牌。我不想这样做，所以它对用户来说是无缝的。我觉得 ADFS 应该支持此请求的 SSO 身份验证（使用直通 Windows 身份验证）。这可能吗？

这是需要凭据的典型推荐代码：

public SecurityToken GetSamlToken()
{
        using (var factory = new WSTrustChannelFactory(
        new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
        new EndpointAddress(new Uri("https://serv/adfs/services/trust/13/usernamemixed"))))
        {
        factory.Credentials.UserName.UserName = "username";
        factory.Credentials.UserName.Password = "password";
        factory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
        factory.TrustVersion = TrustVersion.WSTrust13;                
        WSTrustChannel channel = null;                
        try
        {
            string KeyType;
            var rst = new RequestSecurityToken
                          {
                              RequestType = WSTrust13Constants.RequestTypes.Issue,
                              AppliesTo = new EndpointAddress("net.tcp://localhost:xxxx/Service1/mex"),                         
                              KeyType = Microsoft.IdentityModel.Protocols.WSTrust.WSTrust13Constants.KeyTypes.Bearer,                                        
                          };

            channel = (WSTrustChannel)factory.CreateChannel();

            return channel.Issue(rst);
        }
        finally
        {
            if (channel != null)
            {
                channel.Abort();
            }

            factory.Abort();
        }
    }
}

谢谢您的帮助！

标签： c#tokensamladfs