如何禁用SecurityTokenResolver主题密钥识别(How to disable Sub

我在处理一个WIF令牌SAML2其中包含一个EncryptedAssertion。 该加价不包含“主题识别钥匙”扩展属性，因此WIF SecurityTokenHandler，因为它试图获得来自LocalMachineStore /个人正确的X509证书失败。

这个问题显然是该证书用于加密令牌不包含SKI扩展，当然还有令牌生成代码（JAVA）不似乎确实需要它。 为避免修改代码生成是有办法，我可以得到WIF SecuityTokenResolver不检查接收的令牌为滑雪而只是直接使用本地存储的证书来解密令牌？

Answer 1:

最后我只是实现了自定义SecurityTokenResolver并实施了TryResolveSecurityKeyCore方法。

下面是代码：

public class mySaml2SSOSecurityTokenResolver : SecurityTokenResolver
{
    List<SecurityToken> _tokens;

    public PortalSSOSecurityTokenResolver(List<SecurityToken> tokens)
    {
        _tokens = tokens;
    }
    protected override bool TryResolveSecurityKeyCore(System.IdentityModel.Tokens.SecurityKeyIdentifierClause keyIdentifierClause, out System.IdentityModel.Tokens.SecurityKey key)
    {
        var token = _tokens[0] as X509SecurityToken;

        var myCert = token.Certificate;

        key = null;

        try
        {

            var ekec = keyIdentifierClause as EncryptedKeyIdentifierClause;

            if (ekec != null)
            {

                switch (ekec.EncryptionMethod)
                {

                    case "http://www.w3.org/2001/04/xmlenc#rsa-1_5":
                        {
                            var encKey = ekec.GetEncryptedKey();

                            var rsa = myCert.PrivateKey as RSACryptoServiceProvider;

                            var decKey = rsa.Decrypt(encKey, false);

                            key = new InMemorySymmetricSecurityKey(decKey);

                            return true;

                        }

                }

                var data = ekec.GetEncryptedKey();

                var id = ekec.EncryptingKeyIdentifier;

            }

        }

        catch (Exception ex)
        {
           // Do something here            }

            return true;

    }

    protected override bool TryResolveTokenCore(System.IdentityModel.Tokens.SecurityKeyIdentifierClause keyIdentifierClause, out System.IdentityModel.Tokens.SecurityToken token)
    {
        throw new NotImplementedException();
    }

    protected override bool TryResolveTokenCore(System.IdentityModel.Tokens.SecurityKeyIdentifier keyIdentifier, out System.IdentityModel.Tokens.SecurityToken token)
    {
        throw new NotImplementedException();
    }
}

}

文章来源: How to disable Subject Key Identifier in SecurityTokenResolver