调用ADFS SSO认证的SharePoint Rest API遇绑定匹配问题求助

场景描述 #

开发基于.NET Framework 4.6.1的应用，需通过WS-Trust向ADFS认证并获取SAML令牌，以此调用采用ADFS SSO认证的SharePoint Rest API。

当前实现代码 #

public static GenericXmlSecurityToken GetSamlToken(string username, string password, string adfsUrl, string relyingParty)
{
    var binding = new WSHttpBinding(SecurityMode.TransportWithMessageCredential);
    binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
    binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
    binding.MaxReceivedMessageSize = 20000000;

    var factory = new WSTrustChannelFactory(binding, new EndpointAddress(adfsUrl))
    {
        TrustVersion = TrustVersion.WSTrust13
    };

    factory.Credentials.UserName.UserName = username;
    factory.Credentials.UserName.Password = password;

    var rst = new RequestSecurityToken
    {
        RequestType = RequestTypes.Issue,
        KeyType = KeyTypes.Bearer,
        AppliesTo = new EndpointReference(relyingParty),
        TokenType = "urn:oasis:names:tc:SAML:1.1:assertion"
    };

    var channel = (WSTrustChannel)factory.CreateChannel();
    return (GenericXmlSecurityToken)channel.Issue(rst);
}

运行错误信息 #

The message with Action 'http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT' cannot be processed at the receiver, due to a ContractFilter mismatch at the EndpointDispatcher.

补充信息 #

• 使用UPN格式邮箱登录
• ADFS依赖方信任标识符为urn:sharepoint:facilitiesuat
• 已引用System.IdentityModel、System.ServiceModel包

已尝试操作 #

• 切换TokenType为SAML 1.1和2.0
• 确保绑定与端点使用TransportWithMessageCredential
• 验证ADFS元数据端点和依赖方信任配置
• 尝试UserNameWSTrustBinding但框架不支持

问题排查与解决方案 #

1. 修正ADFS端点地址 #

错误中的RST/SCT表明客户端尝试请求安全上下文令牌（SCT），但ADFS的用户名密码认证端点不支持这类请求。需将adfsUrl替换为ADFS的UserNameMixed端点，格式为：
https://<你的ADFS服务器地址>/adfs/services/trust/13/usernamemixed

2. 调整绑定配置，禁用安全上下文协商 #

修改绑定配置，明确禁用安全上下文令牌请求和服务凭据协商，匹配ADFS的要求：

var binding = new WSHttpBinding(SecurityMode.TransportWithMessageCredential);
binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
// 禁用安全上下文令牌，避免触发RST/SCT请求
binding.Security.Message.EstablishSecurityContext = false;
// ADFS不需要协商服务凭据
binding.Security.Message.NegotiateServiceCredential = false;
binding.MaxReceivedMessageSize = 20000000;

3. 优化RequestSecurityToken参数 #

• 优先使用SAML 2.0令牌（ADFS对其支持更完善，除非SharePoint明确要求1.1）：
  TokenType = "urn:oasis:names:tc:SAML:2.0:assertion"
• 确保AppliesTo中的relyingParty与ADFS依赖方信任的标识符完全一致（区分大小写）

4. 验证ADFS依赖方信任配置 #

• 确认依赖方信任已启用WS-Trust协议，且允许用户名密码认证
• 检查依赖方信任的标识符与代码中relyingParty完全匹配

内容的提问来源于stack exchange，提问作者Alina Anjum