How to convert SAML XML token string to either Sec

问题:

My context:

• .Net RESTful web service
• Client (mixed platforms, technologies, lib capabilities) has obtained a SAML token
• Trying to accept the token for authentication/authorization in the REST service
  • in HTTP Authorization / X-Authorization header
  • as query parameter
• Will also support SWT later, but need to get SAML tokens going

Details:

I have a SAML token in a string:

<saml:Assertion xmlns:saml="..." ...> ..etc... </>

In an HttpModule, I want to convert this into a ClaimsPrincipal so that my service can do the usual Thread.CurrentPrincipal as IClaimsPrincipal stuff.

I found a couple enticing pages/blogs/etc... that looked helpful:

• Cibrax's Idea for passing the token in the HTTP Authorization header
• Dominick Baier on something similar for SWT, with mention of easily doing same for SAML

I'm stuck literally trying to turn the SAML token into the ClaimsPrincipal (via SecurityToken intermediate step or direct... happy either way). The sample code from Cibrax's idea uses the following for the crucial verification and deserialization step:

SecurityTokenSerializer securityTokenSerializer 
    = new SecurityTokenSerializerAdapter(
        FederatedAuthentication.SecurityTokenHandlers, 
        MessageSecurityVersion.Default.SecurityVersion, 
        false, new SamlSerializer(), null, null);

SecurityToken theToken 
    = WSFederationAuthenticationModule.GetSecurityToken(
        theSamlTokenInStringForm, securityTokenSerializer);

The wall I've hit is that the RTM version of WIF does not expose this overload of GetSecurityToken... it only exposes:

WSFederationAuthenticationModule fam = new WSFederationAuthenticationModule();
SecurityToken theToken = fam.GetSecurityToken(HttpRequest theRequest);
SecurityToken theToken = fam.GetSecurityToken(SignInResponseMessage message);

Thanks for helping me to get unstuck!

Tyler

回答1:

Just found this helpful. http://www.tecsupra.com/blog/system-identitymodel-manually-parsing-the-saml-token/

Basic idea: You need the XML of the "Audience"-node and then you can use the SecurityTokenHandlerCollection and use "ValidateToken"

From the post:

       string samlTokenXml = signInResponseXml
            .DocumentElement  // <trust:RequestSecurityTokenResponseCollection>
            .ChildNodes[0] // <trust:RequestSecurityTokenResponse>
            .ChildNodes[2] // <trust:RequestedSecurityToken>
            .InnerXml; // <Assertion>

        var xmlTextReader = new XmlTextReader(new StringReader(samlTokenXml));

        SecurityTokenHandlerCollection handlers = 
       FederatedAuthentication.FederationConfiguration.IdentityConfiguration.SecurityTokenHandlers;

        // read the token
        SecurityToken securityToken = handlers.ReadToken(xmlTextReader);

回答2:

I want to share some resources I found very useful in implementing essentially the same scenario. Basically, Dominick Baier is a god in this space. His blog is full of great info on the subject:

http://leastprivilege.com/

For converting a SAML/SWT token to IClaimsIdentity in a RESTful service:

http://www.develop.com/wcfrest/

http://identitymodel.codeplex.com/

回答3:

For resolving the last exception please check the tag and its contents and make sure its correct. I can't say which element has issue. We go this error some times and everytime the reason was malformed identitymodel section.

回答4:

Ok, some progress... if I do the following, I get further:

Microsoft.IdentityModel.Configuration.ServiceConfiguration serviceConfig
    = new Microsoft.IdentityModel.Configuration.ServiceConfiguration();

// Now read the token and convert it to an IPrincipal
SecurityToken theToken = null;
ClaimsIdentityCollection claimsIdentity = null;
using (XmlReader reader = XmlReader.Create(new StringReader(authSamlString)))
{
    theToken = serviceConfig.SecurityTokenHandlers.ReadToken(reader);
    claimsIdentity = serviceConfig.SecurityTokenHandlers.ValidateToken(theToken);
}

IPrincipal principal = new ClaimsPrincipal(claimsIdentity);

The next wall I've hit:

I'm now getting an exception in the wizard-generated REST service host allocation here:

<%@ ServiceHost Language="C#" Debug="true" Service="Sample.RestService.Service" Factory="Sample.RestService.AppServiceHostFactory"%>

using System;
using System.ServiceModel;
using System.ServiceModel.Activation;
using Microsoft.ServiceModel.Web.SpecializedServices;

namespace Sample.RestService 
{
  class AppServiceHostFactory : ServiceHostFactory
  {
    protected override ServiceHost CreateServiceHost(Type serviceType, Uri[] baseAddresses)
    {
        /// ***** The exception occurs on the next line *****
        return new SingletonServiceHost(serviceType, baseAddresses);
    }
  }
}

The exception details:

System.Configuration.ConfigurationErrorsException occurred
  Message="This element is not currently associated with any context"
  Source="System.Configuration"
  BareMessage="This element is not currently associated with any context"
  Line=0
  StackTrace:
       at System.Configuration.ConfigurationElement.get_EvaluationContext()
  InnerException: {{NONE}}