Federated authentication of WCF web role using ADFS

Question

Hello,

I have followed the AZURE training kid sample "Federated identity with WCF Web role" and created a sample wcf service.

After modifying the bindings created by Fed util tool to custom binding as suggested by the lab I am able to run my service successfully.

I have added a service reference to my service in a console application.

When I run the client application, the application is trying to connect o Card Space and throwing an "Invalid Policy " error.

Kindly help me understanding the issue and a quick solutionto fix this issue.

Thanks,

---

kesari suresh

Answer 1

You need to set the interactive support to false before setting the credentials, like this:

Calc.CalcWithAuthClient client = new Calc.CalcWithAuthClient();

client.ClientCredentials.SupportInteractive = false;
client.ClientCredentials.UserName.UserName = Console.ReadLine();
client.ClientCredentials.UserName.Password = Console.ReadLine();

I do not know the exact reason why you need to do it, maybe someone else can explain.

---

Developer Security MVP | http://www.steveonsecurity.com

Answer 2

Steve,

This procedure is asking me to enter my credentials. Is this the correct way?

After entering the credentials I am receiving an error "SOAP security negotiation with service failed"

Help me in fixing thi sissue.

---

kesari suresh

Answer 3

The issue I am receiving is some thing like

"sing WS-Metadata Exchange or DISCO.
Error: Obtaining metadata from issuer 'https://testwcf/adfs/services/trust/mex'
failed with error 'System.InvalidOperationException: Metadata contains a referen
ce that cannot be resolved: 'https://testwcf/adfs/services/trust/mex'. ---> Syst"

Answer 4

Any help would be appreciated.

---

kesari suresh

Answer 5

Hi Kesari,

Thanks for your question.

I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

Thanks,

---

Wengchao Zeng
Please mark the replies as answers if they help or unmark if not.
If you have any feedback about my replies, please contact [e-mail].
Microsoft One Code Framework

Answer 6

Hello kesari,

As to this error:

"sing WS-Metadata Exchange or DISCO.
 Error: Obtaining metadata from issuer 'https://testwcf/adfs/services/trust/mex'
 failed with error 'System.InvalidOperationException: Metadata contains a referen
 ce that cannot be resolved: 'https://testwcf/adfs/services/trust/mex'. ---> Syst"

Can I ask you what happens if you access the following URL in browser? Is the server sertificate the following site uses trusted by client machine?

 'https://testwcf/adfs/services/trust/mex'

Thanks,

---

Wengchao Zeng
Please mark the replies as answers if they help or unmark if not.
If you have any feedback about my replies, please contact [e-mail].
Microsoft One Code Framework

Answer 7

After trying and making few changes I am still stuck with this issue. Currently I am receiving an error as below when accessing my service from client.

"ID3242: The security token could not be authenticated or authorized"

Kindly help me resolving this issue.

Thanks,

---

kesari suresh

Answer 8

Hi,

Based on the issue and consulting with colleagues your question falls into a support category which requires a more in-depth level of support. 

Please visit the below link to see the various Azure support options that are available to better meet your needs.

Support
http://www.microsoft.com/windowsazure/support/

Blogs
http://blogs.msdn.com/b/windowsazure/
http://blogs.msdn.com/b/avkashchauhan/

---

bill boyce

Answer 9

Bill,

I have raised a support ticket and working for a resolution.

Thank You.

---

kesari suresh

Answer 10

 

Hi Kesari,

Please post your resolution when you gain your answer.

 

Thank You!

---

bill boyce

Answer 11

Hi Kesari,

Any updates on the resolution?

 

Thanks.

Answer 12

The Azure support team was not able to fix the issue. I was told that the training kit sample only works fine with a local STS. If th etraining kit sample needs to me modified to work with ADFS it requires good amount of tweaking from WCF security perspective.

 

Thanks,

---

kesari suresh