使用WSFAM的带有被动STS的WCF应用程序服务

Question

There are lots of examples which show a ASP.NET web application that is secured with Passive STS. I'm trying to apply a working ASP.NET example on simple WCF Application Service, using WSFAM, SAM, VS2012/.Net4.5. Once I open up the browser on localhost/Service1.svc the browser is redirected to the STS, posts the token back to the service (RP) and then gets redirected again to the STS, the loop goes endlessly.

I plan on implementing ASMX endpoints eventually, which is why I have to use WCF.

Does it make sense that a WCF will use Passive STS for authentication?

Answer 1

For WCF you should have a look at the WSFederationBinding. The passive scenario makes little sense for WCF service. A Passive scenario will always show a user interface on the STS. You should normally obtain a token in the part of your app that has a user interface ( a website or a windows app) and then pass the token to the WCF service.