Quantcast
Channel: Azure Active Directory forum
Viewing all articles
Browse latest Browse all 16000

Error requesting SAML2 token from Azure Security Token Service using WS-Trust

$
0
0

I have built my own security token service for test purposes. I now wish to use Azure to issue SAML2 tokens under WS-Trust. For simplicity I'm using the Microsoft ACS Samples to illustrate my issue.

I have set up a Relying Party in ACS and configured ALL of the associated token signing and encrypting certificates. When I request a token using the following standard code:

                                        

static void GetTokenFromAzure2() {


            string acsCertificateEndpoint = String.Format("https://{0}.{1}/v2/wstrust/13/certificate", SamplesConfiguration.ServiceNamespace, SamplesConfiguration.AcsHostUrl);
            var address = new EndpointAddress(new Uri(acsCertificateEndpoint), EndpointIdentity.CreateDnsIdentity(GetServiceCertificateSubjectName()));            

            WSTrustChannelFactory trustChannelFactory = new WSTrustChannelFactory(new CertificateWSTrustBinding(SecurityMode.Transport), address);
            trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;
            trustChannelFactory.Credentials.ServiceCertificate.DefaultCertificate = GetServiceCertificate();
            trustChannelFactory.Credentials.ClientCertificate.Certificate = GetClientCertificateWithPrivateKey();
            trustChannelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
            trustChannelFactory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
            trustChannelFactory.Endpoint.Behaviors.Add(new InspectorBehavior());

            //trustChannelFactory.ConfigureChannelFactory();

            try {
                var request = new RequestSecurityToken(RequestTypes.Issue) {
                    AppliesTo = new EndpointReference(ServiceAddress),
                    TokenType = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"                   


                };

                WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();
                RequestSecurityTokenResponse rstr = null;
                SecurityToken token = channel.Issue(request, out rstr);

            }
            finally {
                trustChannelFactory.Close();
            }

        }

I keep getting the following error: ACS10001: An error occurred while processing the SOAP header. I have wrote message inspectors so that I can view the outgoing RST request and all is fine. I have even tried with different clients using Ruby and NodeJS and I get the same error from Azure. I have checked and my code works with other configured Security Token Servers. I can't understand why this will not work with Azure and Google does show that a few people also have this error but no solution. Please can anybody help me. 


Viewing all articles
Browse latest Browse all 16000

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>