1. 技术文章
  2. UseWsFederationAuthentication - AuthenticationException: The remote certificate is invalid according to the validation procedure

UseWsFederationAuthentication - AuthenticationException: The remote certificate is invalid according to the validation procedure

由 给你一囗甜甜゛ 提交于 2019-12-06 10:45:18
Thuan

According to stack trace, the first step of the authentication process is that your application needs to download ADFS' metadata via https and that the SSL certificate doesn't pass the validation procedure.

You can refer to other questions in SO for what the validation procedure is: The remote certificate is invalid according to the validation procedure

There are probably two ways to fix it:

  1. The hack, must-not-use-for-production is to disable the check: "The remote certificate is invalid according to the validation procedure." using Gmail SMTP server
  2. If the SSL certificate is not self-signed and is still valid (e.g. is issued by a trusted CA, is not expired and is not revoked yet), you may need to check your client machine if it trusts the CA. This case is rarer.
Captain America

Again, thank you Thuan for your answer.

From the answer I was able to think through what really was happening (which is always critical in order to figure things out). The key was realizing that the issue stemmed from the remote certificate failing the validation check and nothing else. So I found that in the UseWsFederationAuthentication call there is a BackchannelCertificateValidator option that could be used to validate if the certificate was valid or not. I then found this post that helped me come up with the code to validate the certificate.

The post found their code from the Microsoft site (https://msdn.microsoft.com/en-us/library/office/dd633677(v=exchg.80).aspx). In the article it says this about the code.

The certificate validation callback method in this example provides sufficient security for development and testing of EWS Managed API applications. However, it may not provide sufficient security for your deployed application. You should always make sure that the certificate validation callback method that you use meets the security requirements of your organization.

So I will have to figure something out so that it only runs in debug mode.

The code:

public void ConfigureAuth(IAppBuilder app)
        {

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseWsFederationAuthentication(
                new WsFederationAuthenticationOptions
                {

                    BackchannelCertificateValidator = new CertificateValidator(),

                    Wtrealm = realm,
                    MetadataAddress = adfsMetadata
                });
        }

The class:

public class CertificateValidator : ICertificateValidator
    {
        public bool Validate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
        {
            // If the certificate is a valid, signed certificate, return true.
            if (sslPolicyErrors == System.Net.Security.SslPolicyErrors.None)
            {
                return true;
            }

            // If there are errors in the certificate chain, look at each error to determine the cause.
            if ((sslPolicyErrors & System.Net.Security.SslPolicyErrors.RemoteCertificateChainErrors) != 0)
            {
                if (chain != null && chain.ChainStatus != null)
                {
                    foreach (System.Security.Cryptography.X509Certificates.X509ChainStatus status in chain.ChainStatus)
                    {
                        if ((certificate.Subject == certificate.Issuer) &&
                           (status.Status == System.Security.Cryptography.X509Certificates.X509ChainStatusFlags.UntrustedRoot))
                        {
                            // Self-signed certificates with an untrusted root are valid. 
                            continue;
                        }
                        else
                        {
                            if (status.Status != System.Security.Cryptography.X509Certificates.X509ChainStatusFlags.NoError)
                            {
                                // If there are any other errors in the certificate chain, the certificate is invalid,
                                // so the method returns false.
                                return false;
                            }
                        }
                    }
                }

                // When processing reaches this line, the only errors in the certificate chain are 
                // untrusted root errors for self-signed certificates. These certificates are valid
                // for default Exchange server installations, so return true.
                return true;
            }
            else
            {
                // In all other cases, return false.
                return false;
            }
        }
    }
标签
asp.net-mvc
ssl-certificate
owin
ws-federation
adfs3.0
易学教程内所有资源均来自网络或用户发布的内容，如有违反法律规定的内容欢迎反馈！
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!