Claims系列 - ID4036错误(The key needed to decrypt the encrypted security token could not be resolved from the following security key identifier)

错误现象

View Code

1 public ServiceConfiguration()

2 {

3 this._certificateValidationMode = DefaultCertificateValidationMode;

4 this._claimsAuthenticationManager = new ClaimsAuthenticationManager();

5 this._claimsAuthorizationManager = new ClaimsAuthorizationManager();

6 this._exceptionMapper = new ExceptionMapper();

7 this._revocationMode = DefaultRevocationMode;

8 this._serviceName = DefaultServiceName;

9 this._serviceMaxClockSkew = DefaultMaxClockSkew;

10 this._trustedStoreLocation = DefaultTrustedStoreLocation;

11 MicrosoftIdentityModelSection current = MicrosoftIdentityModelSection.Current;

12 ServiceElement element = (current != null) ? current.ServiceElements.GetElement(DefaultServiceName) : null;

13 this.LoadConfiguration(element);

14 }

注意到最后调用了LoadConfiguration进行初始化,再看其内部实现：

1 protected void LoadConfiguration(ServiceElement element)

2 {

3 if (element != null)

4 {

5

6 //省略前面无关代码

7 if ((this._serviceCertificate == null) && element.ServiceCertificate.IsConfigured)

8 {

9 this._serviceCertificate = GetServiceCertificate(element);

10 }

11 //省略后面无关代码

12 }

13 this._securityTokenHandlerCollectionManager = this.LoadHandlers(element);

14 }

再看GetServiceCertificate()

1 private static X509Certificate2 GetServiceCertificate(ServiceElement element)

2 {

3 X509Certificate2 certificate2;

4 try

5 {

6 X509Certificate2 certificate = element.ServiceCertificate.GetCertificate();

7 if (certificate != null)

8 {

9 X509Util.EnsureAndGetPrivateRSAKey(certificate);

10 }

11 certificate2 = certificate;

12 }

13 catch (ArgumentException exception)

14 {

15 throw DiagnosticUtil.ExceptionUtil.ThrowHelperConfigurationError(element, "serviceCertificate", exception);

16 }

17 return certificate2;

18 }

至此, 终于知道X509证书默认是从ServiceElement即配置文件中的<microsoft.identitymodel><service><servicecertificate>节点。由此我们可得到如下两种解决方案：

解决方案

1 设置配置文件中的<microsoft.identitymodel><service><servicecertificate>节点

a)找开Relying Party应用程序的配置文件;

b)设置X509证书如下：



2 在FederatedAuthentication.ServiceConfigurationCreated事件处理函数中设置

a) 在Relying Party工程中添加Global.asax文件(如果不存在的话)；

b) 添加Application_Start事件处理函数