c# – 通过AJAX将WIF发送到单独的域

为此,我做了所有必要的CORS位,以便能够将我们的cookie传递给API,但是当API尝试处理cookie时,它无法解密它.我的理解是,这是因为领域不正确.

我尝试这样做时得到的错误如下：

InvalidOperationException: ID1073: A CryptographicException occurred when attempting to decrypt the cookie using the ProtectedData API (see inner exception for details). If you are using IIS 7.5,this could be due to the loadUserProfile setting on the Application Pool being set to false.

如果我使用带有：1444域的cookie手动发出相同的请求,一切正常(所以我认为loadUserProfile的东西是红鲱鱼).

我认为问题是我不能将这个cookie重用于另一个领域.但如果是这种情况,我怎样才能在javascript中执行此委派？实际上甚至没有实际将用户重定向到STS以获得另一个领域的cookie吗？有没有更好的方法来处理这个JavaScript代理？

有用的支持数据：

我们的API端的WIF配置：

<modules runAllManagedModulesForAllRequests="true">
        <add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule,Microsoft.IdentityModel,Version=3.5.0.0,Culture=neutral,PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />
        <add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule,PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />
    </modules>

…

<microsoft.identityModel>
    <service>
        <securityTokenHandlers>
            <add type="Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler,PublicKeyToken=31bf3856ad364e35">
                <sessionTokenRequirement lifetime="1:00" />
            </add>
        </securityTokenHandlers>
        <audienceUris>
            <add value="http://localhost:1444/" />
        </audienceUris>
        <federatedAuthentication>
            <wsFederation passiveRedirectEnabled="true" issuer="http://localhost:1339/account/sign-in" realm="http://localhost:1444/" requireHttps="false" persistentCookiesOnPassiveRedirects="false" />
            <cookieHandler requireSsl="false" path="/" name="TheCookieMonster" persistentSessionLifetime="60" />
        </federatedAuthentication>
        <applicationService>
            <claimTypeRequired>
                <!--This claim gets mapped to the User.Identity.Name-->
                <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="false" />
                <!--Some Other Custom claims-->
            </claimTypeRequired>
        </applicationService>
        <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry,PublicKeyToken=31bf3856ad364e35">
            <trustedIssuers>
                <add thumbprint="a_thumbprint_key_for_our_cert" name="http://localhost:1339/" />
            </trustedIssuers>
        </issuerNameRegistry>
    </service>
</microsoft.identityModel>

网站端的WIF配置：

(相同但有：1337)

<modules runAllManagedModulesForAllRequests="true">
        <add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule,PublicKeyToken=31bf3856ad364e35">
                <sessionTokenRequirement lifetime="1:00" />
            </add>
        </securityTokenHandlers>
        <audienceUris>
            <add value="http://localhost:1337/" />
        </audienceUris>
        <federatedAuthentication>
            <wsFederation passiveRedirectEnabled="true" issuer="http://localhost:1339/account/sign-in" realm="http://localhost:1337/" requireHttps="false" persistentCookiesOnPassiveRedirects="false" />
            <cookieHandler requireSsl="false" path="/" name="TheCookieMonster" persistentSessionLifetime="60" />
        </federatedAuthentication>
        <applicationService>
            <claimTypeRequired>
                <!--This claim gets mapped to the User.Identity.Name-->
                <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="false" />
                <!--Some Custom claims-->
            </claimTypeRequired>
        </applicationService>
        <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry,PublicKeyToken=31bf3856ad364e35">
            <trustedIssuers>
                <add thumbprint="a_thumbprint_key_for_our_cert" name="http://localhost:1339/" />
            </trustedIssuers>
        </issuerNameRegistry>
    </service>
</microsoft.identityModel>

网络标签的外观如下：

我认为这已被取消,因为JS已经检测到某种安全性废话.

>机器密钥在两个站点之间共享
>两者都在运行WIF 3.5