asp.net-web-api – 认证/授权MVC 5和Web API – Katana / Owin

我可以提供OWIN中的WsFederation选项很好但需要cookie …而且它们与使用cookie的本地身份验证不同. ADFS 2.0 / WsFederation使用AuthenticationType =“Cookies”,本地身份验证使用AuthenticationType =“ApplicationCookie”.就我所知,它们显然是不相容的.我认为你必须为ADFS使用令牌身份验证,但我相信在2012R2上需要ADFS 3.0.为此使用OWIN OAuth.

更新：经过一段时间的努力,我已经想出如何让这两种身份验证类型在同一个Web应用程序中和平共存.使用OWIN,设置调用UseCookieAuthentication TWICE,一次启用新的WsFederationAuthentication中间件,再次启用本地cookie身份验证.这不是直观的,但在幕后,为每个指定不同的身份验证类型将它们设置为不同的auth“引擎”.以下是我在Startup中的外观：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,LoginPath = new PathString("/Account/Login"),Provider = new CookieAuthenticationProvider
        {
            OnResponseSignIn = ctx =>
            {
                ctx.Identity = TransformClaims(ctx,app);
            }
        }
});

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    Provider = new CookieAuthenticationProvider
    {
        OnResponseSignIn = ctx =>
        {
            ctx.Identity = TransformClaims(ctx,app);
        }
    }
});

app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
{
    Wtrealm = Realm,MetadataAddress = Metadata,Caption = "Active Directory",SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType
});

这成功地允许用户对本地SQL表或ADFS 2.0进行身份验证. TransformClaims标注允许我规范化这两个提供者之间的声明,使它们保持一致.

编辑：这是一个非常基本的TransformClaims.你可以在其中做很多事情：从你的数据库中获取用户,设置导航声明,自定义权限,角色集合等等.我刚刚从一个更大的实现中构建了这个精简版本,所以我没有运行它,但希望你能够了解如何利用OnResponseSignIn事件.

private static ClaimsIdentity TransformClaims(CookieResponseSignInContext ctx,IAppBuilder app)
{
    var ident = ctx.Identity;

    var claimEmail = ident.Claims.SingleOrDefault(c => c.Type == ClaimTypes.Email);
    var claimName = ident.Claims.SingleOrDefault(c => c.Type == ClaimTypes.Name);

    //normalize my string identifier
    var loginString = (claimEmail != null) ? claimEmail.Value : (claimName != null) ? claimName.Value : null;
    var efctx = ctx.OwinContext.Get<DBEntities>();

    var user = UserBL.GetActiveUserByEmailOrName(efctx,loginString);
    if (user == null)
    {
        //user was auth'd by ADFS but hasn't been auth'd by this app
        ident.AddClaim(new Claim(ClaimTypesCustom.Unauthorized,"true"));
        return ident;
    }

    if (ident.Claims.First().Issuer == "LOCAL AUTHORITY")
    {
        //Local
        //local already has claim type "Name"
        //local didn't have claim type "Email" - adding it
        ident.AddClaim(new Claim(ClaimTypes.Email,user.Email));
    }
    else
    {
        //ADFS
        //ADFS already has claim type "Email"
        //ADFS didn't have claim type "Name" - adding it
        ident.SetClaim(ClaimTypes.Name,user.UserName);
    }

    //now ident has "Name" and "Email",regardless of where it came from
    return ident;
}