CoreWCF自定义绑定报错：无法创建BearerKey类型密钥元素求解决

错误根源 #

你遇到的错误是因为WS2007FederationHttpBinding默认使用的MessageSecurityVersion对应较旧的WS-Security规范（如WSSecurity11、WSTrustFebruary2005），这些规范不支持BearerKey类型的密钥。Bearer密钥支持是在后续的WS-Security版本（如WSSecurity13、WSTrust13）中引入的。

解决方案 #

最直接的修复方式是将自定义绑定的基类从WS2007FederationHttpBinding切换为WS2012FederationHttpBinding，该绑定默认使用支持BearerKey的MessageSecurityVersion。

修改后的自定义绑定代码如下：

public class CustomFederatedBufferedBinding : WS2012FederationHttpBinding
{
    public CustomFederatedBufferedBinding(WSFederationHttpSecurityMode mode) : base(mode)
    {
        Security.Message.EstablishSecurityContext = false;
        Security.Message.IssuedKeyType = CoreWCF.IdentityModel.Tokens.SecurityKeyType.BearerKey;
        Security.Message.NegotiateServiceCredential = true;
        Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.Default;
        CloseTimeout = new TimeSpan(0, 0, 0, BindingHelper.JWTCloseTimeout, 0);
        SendTimeout = new TimeSpan(0, 0, 0, BindingHelper.JWTSendTimeout, 0);
        ReceiveTimeout = new TimeSpan(0, 0, 0, BindingHelper.JWTReceiveTimeout, 0);
        Name = "federated";
    }

    protected override TransportBindingElement GetTransport()
    {
        var httpBinding = new HttpsTransportBindingElement()
        {
            MaxBufferPoolSize = BindingHelper.JWTMaxBufferPoolSize,
            MaxReceivedMessageSize = BindingHelper.JWTMaxReceivedMessageSize,
        };
        return httpBinding;
    }

    protected override SecurityBindingElement CreateMessageSecurity()
    {
        var sec = base.CreateMessageSecurity();
        sec.LocalServiceSettings.MaxClockSkew = TimeSpan.FromHours(24);
        return sec;
    }
}

备选方案（如需保留WS2007绑定） #

如果你必须继续使用WS2007FederationHttpBinding，可以手动修改SecurityBindingElement的MessageSecurityVersion为支持BearerKey的版本：

protected override SecurityBindingElement CreateMessageSecurity()
{
    var sec = base.CreateMessageSecurity();
    // 设置支持BearerKey的安全版本
    sec.MessageSecurityVersion = MessageSecurityVersion.WSSecurity13WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10;
    sec.LocalServiceSettings.MaxClockSkew = TimeSpan.FromHours(24);
    return sec;
}

注意：此方式可能存在兼容性问题，因为WS2007绑定的其他组件是基于旧规范设计的，优先推荐使用WS2012绑定方案。

内容的提问来源于stack exchange，提问作者Parvez Siddique