RequestSecurityToken 类

定义

public ref class RequestSecurityToken : System::IdentityModel::Protocols::WSTrust::WSTrustMessage

public class RequestSecurityToken : System.IdentityModel.Protocols.WSTrust.WSTrustMessage

type RequestSecurityToken = class
    inherit WSTrustMessage

Public Class RequestSecurityToken
Inherits WSTrustMessage

继承

Object

OpenObject

WSTrustMessage

RequestSecurityToken

示例

本主题中使用的代码示例取自 Custom Token 示例。 此示例提供允许处理简单 Web 令牌（SWT）的自定义类，并包括能够提供 SWT 令牌的被动 STS 的实现。 STS 由派生自 SecurityTokenService的类实现。 从其令牌颁发管道调用的类的许多方法 SecurityTokenService 都将其参数视为一个 RequestSecurityToken 对象。 有关此示例和其他可用于 WIF 的示例以及下载位置的信息，请参阅 WIF 代码示例索引。

下面的代码示例演示方法的 SecurityTokenService.GetScope 实现。 该方法采用 RequestSecurityToken 此参数的参数和属性之一，用于设置方法返回的对象的属性 Scope 。

// Certificate Constants
private const string SIGNING_CERTIFICATE_NAME = "CN=localhost";
private const string ENCRYPTING_CERTIFICATE_NAME = "CN=localhost";

private SigningCredentials _signingCreds;
private EncryptingCredentials _encryptingCreds;
// Used for validating applies to address, set to URI used in RP app of application, could also have been done via config
private string _addressExpected = "http://localhost:19851/";

/// <summary>
/// This method returns the configuration for the token issuance request. The configuration
/// is represented by the Scope class. In our case, we are only capable of issuing a token to a
/// single RP identity represented by the _encryptingCreds field.
/// </summary>
/// <param name="principal">The caller's principal</param>
/// <param name="request">The incoming RST</param>
/// <returns></returns>
protected override Scope GetScope(ClaimsPrincipal principal, RequestSecurityToken request)
{
    // Validate the AppliesTo address
    ValidateAppliesTo( request.AppliesTo );

    // Create the scope using the request AppliesTo address and the RP identity
    Scope scope = new Scope( request.AppliesTo.Uri.AbsoluteUri, _signingCreds );

    if (Uri.IsWellFormedUriString(request.ReplyTo, UriKind.Absolute))
    {
        if (request.AppliesTo.Uri.Host != new Uri(request.ReplyTo).Host)
            scope.ReplyToAddress = request.AppliesTo.Uri.AbsoluteUri;
        else
            scope.ReplyToAddress = request.ReplyTo;
    }
    else
    {
        Uri resultUri = null;
        if (Uri.TryCreate(request.AppliesTo.Uri, request.ReplyTo, out resultUri))
            scope.ReplyToAddress = resultUri.AbsoluteUri;
        else
            scope.ReplyToAddress = request.AppliesTo.Uri.ToString() ;
    }

    // Note: In this sample app only a single RP identity is shown, which is localhost, and the certificate of that RP is 
    // populated as _encryptingCreds
    // If you have multiple RPs for the STS you would select the certificate that is specific to 
    // the RP that requests the token and then use that for _encryptingCreds
    scope.EncryptingCredentials = _encryptingCreds;

    return scope;
}

/// <summary>
/// Validates the appliesTo and throws an exception if the appliesTo is null or appliesTo contains some unexpected address.
/// </summary>
/// <param name="appliesTo">The AppliesTo parameter in the request that came in (RST)</param>
/// <returns></returns>
void ValidateAppliesTo(EndpointReference appliesTo)
{
    if (appliesTo == null)
    {
        throw new InvalidRequestException("The appliesTo is null.");
    }

    if (!appliesTo.Uri.Equals(new Uri(_addressExpected)))
    {
        throw new InvalidRequestException(String.Format("The relying party address is not valid. Expected value is {0}, the actual value is {1}.", _addressExpected, appliesTo.Uri.AbsoluteUri));
    }
}

注解

wst：RequestSecurityToken 元素（message）包含用于从安全令牌服务（STS）请求安全令牌的参数和属性。 消息（或元素）缩写为 RST。 该 RequestSecurityToken 类包含表示 RST 元素的属性。 RST 可以形成与 WS-Trust 定义的任何请求绑定相对应的请求;例如，颁发绑定、续订绑定、验证绑定或取消绑定。 类中的 RequestSecurityToken 许多属性对应于仅存在于这些绑定定义的特定类型的请求中的元素。 根据特定 RequestSecurityToken 对象所表示的请求类型或它所表示的特定请求中存在的参数，该对象的某些属性可能是 null。

STS 在包含 wst：RequestSecurityTokenResponse 元素（RSTR）的消息中返回对请求的响应。 此消息由 RequestSecurityTokenResponse 类表示。

有关此类表示的元素的详细信息，请参阅适用于你的方案的 WS-Trust 规范： 200WS-Trust 5 年 2 月WS-Trust 1.3 或 WS-Trust 1.4。

另请参阅

• SecurityTokenService
• RequestedSecurityToken
• RequestSecurityTokenResponse