使用自定义STS从访问控制服务注销

我正在使用自定义STS的Windows Azure访问控制服务。 我可以通过ACSlogin到我的应用程序,但我有注销function的麻烦。 我已经在我的应用程序中试过这个代码。

WSFederationAuthenticationModule fam = FederatedAuthentication.WSFederationAuthenticationModule; try { FormsAuthentication.SignOut(); } finally { fam.SignOut(true); } Page.Response.Redirect("default.aspx"); 

但它似乎从ACS注销用户,而不是从自定义STS注销。 我应该怎么做才能从STS注销。 在应用程序(RP),ACS或STS中,问题可能出在哪里?

我认为ACS应该要求自定义的STS注销用户,但似乎没有这样做。 我错过了什么?

我为FederatedSignout创建了一个辅助方法,在代码中为我发现的方法(hth)

 public static void FederatedSignOut(string reply = null) { WSFederationAuthenticationmodulee fam = FederatedAuthentication.WSFederationAuthenticationmodulee; // Native FederatedSignOut doesn't seem to have a way for finding/registering realm for singout, get it from the FAM string wrealm = string.Format("wtrealm={0}", fam.Realm); // Create basic url for signout (wreply is set by native FederatedSignOut) string signOutUrl = WSFederationAuthenticationmodulee.GetFederationPassiveSignOutUrl(fam.Issuer, null, wrealm); // Check where to return, if not set ACS will use Reply address configured for the RP string wreply = !string.IsNullOrEmpty(reply) ? reply : (!string.IsNullOrEmpty(fam.Reply) ? fam.Reply : null); WSFederationAuthenticationmodulee.FederatedSignOut(new Uri(signOutUrl), !string.IsNullOrEmpty(wreply) ? new Uri(wreply) : null); // Remarks! Native FederatedSignout has an option for setting signOutUrl to null, even if the documentation tells otherwise. // If set to null the method will search for signoutUrl in Session token, but I couldn't find any information about how to set this. Found some Sharepoint code that use this // Michele Leroux Bustamante had a code example (from 2010) that also uses this form. // Other examples creates the signout url manually and calls redirect. // FAM has support for wsignoutcleanup1.0 right out of the box, there is no need for code to handle this. // That makes it even harder to understand why there are no complete FederatedSignOut method in FAM // When using native FederatedSignOut() no events for signout will be called, if you need this use the FAM SignOut methods instead. } 

这个代码被用在我们用ACS为Web SSO创建的标准RP库中。

ACS的2012年12月更新包括对联合单点登出的支持:

使用WS-Federation协议。 使用ACS使用WS-Federation协议为身份提供商启用单点登录(SSO)的Web应用程序现在可以利用单点登出功能。 当用户退出Web应用程序时,ACS可以自动将用户从身份提供程序中签出,并从其他使用相同身份提供程序的依赖方应用程序中签出。

WS-Federation身份提供程序(包括Active Directory联合身份验证服务2.0和Windows Live ID(Microsoft帐户))启用了此功能。 要启用单一注销,ACS为WS联合身份验证协议端点执行以下任务:

  • ACS识别来自身份提供者的wsignoutcleanup1.0消息,并通过向依赖方应用程序发送wsignoutcleanup1.0消息来作出响应。

  • ACS识别来自依赖方应用程序的wsignout1.0和wreply消息,并通过向依赖方应用程序发送wsignout1.0消息给身份提供者和wsignoutcleanup1.0消息来作出响应。

从代码示例:带有联合注销的ASP.NET MVC 4 ,执行一个像这样的操作从ACS注销:

(请注意,Windows身份基础现已并入.NET 4.5 Framework,这就是为什么下面的新命名空间)

 using System.IdentityModel.Services; using System.IdentityModel.Services.Configuration; public ActionResult Logout() { // Load Identity Configuration FederationConfiguration config = FederatedAuthentication.FederationConfiguration; // Get wtrealm from WsFederationConfiguation Section string wtrealm = config.WsFederationConfiguration.Realm; string wreply; // Construct wreply value from wtrealm (This will be the return URL to your app) if (wtrealm.Last().Equals('/')) { wreply = wtrealm + "Logout"; } else { wreply = wtrealm + "/Logout"; } // Read the ACS Ws-Federation endpoint from web.Config // something like "https://<your-namespace>.accesscontrol.windows.net/v2/wsfederation" string wsFederationEndpoint = ConfigurationManager.AppSettings["ida:Issuer"]; SignOutRequestMessage signoutRequestMessage = new SignOutRequestMessage(new Uri(wsFederationEndpoint)); signoutRequestMessage.Parameters.Add("wreply", wreply); signoutRequestMessage.Parameters.Add("wtrealm", wtrealm); FederatedAuthentication.SessionAuthenticationmodulee.SignOut(); string signoutUrl = signoutRequestMessage.WriteQueryString(); return this.Redirect(signoutUrl); }