SecurityNogotiationException试图发布安全令牌请求

Question

我正在尝试向我的STS提出问题请求，并且我不断获得以下例外：

System.ServiceModel.Security.SecurityNegotiationException' occurred in mscorlib.dll but was not handled in user code

Additional information: Could not establish secure channel for SSL/TLS with authority 'service-location-url-here'.

以下代码正在ASP.NET网站上运行，该网站正在运行我自己的用户帐户。 STS服务需要相互验证，因此我需要使用我的安全令牌请求发送证书。服务器日志抱怨说，消息没有附加证书，因此可以中止操作。

我在哪里失败？

public class StsRequestWrapper
{
  public System.IdentityModel.Tokens.SecurityToken RequestSecurityToken()
  {
      IgnoreCertificateValidation();

      StsRequestUtil util = new StsRequestUtil();
      var certificate = util.GetLocalCertificate();
      var securityTokenElement = util.BuildSampleSecurityTokenElement();
      var trustChannelFactory = GetTrustChannelFactory(certificate);

      try
      {
          RequestSecurityToken rst = CreateSecurityTokenObject(securityTokenElement);
          WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();
          RequestSecurityTokenResponse rstr = null;
          return channel.Issue(rst, out rstr);
      }
      finally
      {
          trustChannelFactory.Close();
      }
  }

  private RequestSecurityToken CreateSecurityTokenObject(SecurityTokenElement securityToken)
  {
      RequestSecurityToken rst = new RequestSecurityToken()
      {
          AppliesTo = new EndpointAddress(new Uri(STS_CONSTANTS.APPLIES_TO_URL)),
          ActAs = securityToken,
          RequestType = RequestTypes.Issue,
          Lifetime = new Lifetime(DateTime.UtcNow, DateTime.UtcNow.AddMinutes(5)),
      };

      var requestClaim = new RequestClaim(STS_CONSTANTS.REQUEST_CLAIM_TYPE, false, STS_CONSTANTS.REQUEST_CLAIM_VALUE);
      rst.Claims.Dialect = STS_CONSTANTS.CLAIMS_DIALECT;
      rst.Claims.Add(requestClaim);
      return rst;
  }

  private WSTrustChannelFactory GetTrustChannelFactory(X509Certificate2 localhostCertificate)
  {

      WS2007HttpBinding binding = new WS2007HttpBinding();
      binding.Security.Mode = SecurityMode.Transport;
      binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;

      var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(new Uri(STS_CONSTANTS.STS_URL)));
      trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;

      trustChannelFactory.Credentials.ClientCertificate.Certificate = localhostCertificate;
      trustChannelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust;
      trustChannelFactory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;

      return trustChannelFactory;
  }

  private static void IgnoreCertificateValidation()
  {
      System.Net.ServicePointManager.ServerCertificateValidationCallback = ((sender, certificate, chain, sslPolicyErrors) => true);
  }

}

Answer 1

事实证明，我需要使用证书Wstrustbinding而不是WS2007HTTPBINDING。

        var binding = new CertificateWSTrustBinding();
        binding.SecurityMode = SecurityMode.Transport;