从adfs服务器获取安全令牌时出错

要根据ADFS进行身份验证并检查我希望从adfs服务器获取安全令牌的声明。但是，我使用的示例代码在请求令牌时始终会生成错误。示例代码如下：从adfs服务器获取安全令牌时出错

private static SecurityToken RequestSamlToken() 
      { 
       var factory = new WSTrustChannelFactory(
        new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential), 
        new EndpointAddress(adfsEndpoint)); 
       factory.TrustVersion = TrustVersion.WSTrust13; 
       factory.Credentials.UserName.UserName = username; 
       factory.Credentials.UserName.Password = password; 

       var rst = new RequestSecurityToken 
       { 
        RequestType = RequestTypes.Issue, 
        KeyType = KeyTypes.Bearer, 
        AppliesTo = new EndpointReference(realm) 
       }; 

       return factory.CreateChannel().Issue(rst); 
      }

我得到以下错误：

类型“System.ServiceModel.FaultException”的未处理的异常发生在System.ServiceModel.dll 其他信息：ID3082 ：请求范围无效或不受支持。

ADFS服务器中是否缺少任何配置不允许服务令牌？另一个使用IdpInitiated Logon的代码片段用于生成SAML令牌。 ADFS的特性如下 -

AcceptableIdentifiers      : {} 
AddProxyAuthorizationRules     : exists([Type == 
              "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value 
              == "S-1-5-32-544", Issuer =~ "^AD AUTHORITY$"]) => issue(Type = 
              "http://schemas.microsoft.com/authorization/claims/permit", Value = 
              "true"); 
                 c:[Type == 
              "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid", 
              Issuer =~ "^AD AUTHORITY$" ] 
                    => issue(store="_ProxyCredentialStore",types=("http 
              ://schemas.microsoft.com/authorization/claims/permit"),query="isProxyTrust 
              ManagerSid({0})", param=c.Value); 
                 c:[Type == 
              "http://schemas.microsoft.com/ws/2008/06/identity/claims/proxytrustid", 
              Issuer =~ "^SELF AUTHORITY$" ] 
                    => issue(store="_ProxyCredentialStore",types=("http 
              ://schemas.microsoft.com/authorization/claims/permit"),query="isProxyTrust 
              Provisioned({0})", param=c.Value); 
ArtifactDbConnection      : Data Source=np:\\.\pipe\microsoft##wid\tsql\query;Initial 
              Catalog=AdfsArtifactStore;Integrated Security=True 
AuthenticationContextOrder     : {urn:oasis:names:tc:SAML:2.0:ac:classes:Password, 
              urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, 
              urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, 
              urn:oasis:names:tc:SAML:2.0:ac:classes:X509...} 
AutoCertificateRollover     : True 
CertificateCriticalThreshold    : 2 
CertificateDuration      : 365 
CertificateGenerationThreshold    : 20 
CertificatePromotionThreshold    : 5 
CertificateRolloverInterval    : 720 
CertificateSharingContainer    : CN=6b987b00-35ce-44d9-97c8-561b6f1ac3dd,CN=ADFS,CN=Microsoft,CN=Program 
              Data,DC=sciemetricdev,DC=com 
CertificateThresholdMultiplier    : 1440 
ClientCertRevocationCheck     : None 
ContactPerson        : 
DisplayName        : ADFS 
IntranetUseLocalClaimsProvider    : False 
ExtendedProtectionTokenCheck    : Allow 
FederationPassiveAddress     : /adfs/ls/ 
HostName         : *************.com 
HttpPort         : 80 
HttpsPort         : 443 
TlsClientPort        : 49443 
Identifier         : http://*******.com/adfs/services/trust 
InstalledLanguage       : en-US 
LogLevel         : {Errors, Information, Verbose, Warnings} 
MonitoringInterval       : 1440 
NetTcpPort         : 1501 
NtlmOnlySupportedClientAtProxy    : False 
OrganizationInfo       : 
PreventTokenReplays      : False 
ProxyTrustTokenLifetime     : 21600 
ReplayCacheExpirationInterval    : 60 
SignedSamlRequestsRequired     : False 
SamlMessageDeliveryWindow     : 5 
SignSamlAuthnRequests      : False 
SsoLifetime        : 480 
PersistentSsoLifetimeMins     : 10080 
KmsiLifetimeMins       : 1440 
PersistentSsoEnabled      : True 
PersistentSsoCutoffTime     : 1/1/0001 12:00:00 AM 
KmsiEnabled        : False 
LoopDetectionEnabled      : True 
LoopDetectionTimeIntervalInSeconds   : 20 
LoopDetectionMaximumTokensIssuedInInterval : 5 
PasswordValidationDelayInMinutes   : 60 
SendClientRequestIdAsQueryStringParameter : False 
WIASupportedUserAgents      : {MSAuthHost/1.0/In-Domain, MSIE 6.0, MSIE 7.0, MSIE 8.0...} 
ExtranetLockoutThreshold     : 2147483647 
ExtranetLockoutEnabled      : False 
ExtranetObservationWindow     : 00:30:00

来源

2015-10-26 TrustyCoder

使用PowerShell，只是仔细检查ADFS财产“AcceptableIdentifiers”。运行：'add-PSSNapin Microsoft.Adfs.PowerShell'加载管理单元。并添加命令get-adfsproperties – 2015-10-27 07:58:52

adfs属性。不知道它是否有帮助！ – TrustyCoder