AD FS 自定义身份验证提供程序未返回身份验证方法声明 [英] AD FS custom authentication provider did not return an authentication method claim

问题描述

我为 AD FS MFA 创建了一个自定义身份验证提供程序.

I have made a custom authentication provider for AD FS MFA.

我在元数据中定义了一个身份验证方法声明:

I have defined an authentication method claim in the metadata:

public string[] AuthenticationMethods
{
    get { return new string[] { "https://schemas.microsoft.com/ws/2012/12/authmethod/otp" }; }
}

我还有一个 TryEndAuthentication 方法(这仅用于实验室目的，一旦这部分工作，我将更改硬编码的 pin):

I also have an TryEndAuthentication method (this is only for lab purposes, I will change the hardcoded pin once this part works):

 public IAdapterPresentation TryEndAuthentication(IAuthenticationContext context, IProofData proofData, System.Net.HttpListenerRequest request, out System.Security.Claims.Claim[] claims)
    {
        claims = null;
        IAdapterPresentation result = null;
        string pin = proofData.Properties["pin"].ToString();
        if (pin == "12345")
        {
            System.Security.Claims.Claim claim = new System.Security.Claims.Claim("https://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "https://schemas.microsoft.com/ws/2012/12/authmethod/otp");
            claims = new System.Security.Claims.Claim[] { claim };
        }
        else
        {
            result = new AdapterPresentation("Authentication failed.", false);
        }
        return result;
    }

但是当我在我的 AD FS 中部署它时，当我正确登录时它会给我这个错误:

But when i deploy this in my AD FS it gives me this error when i sign on correctly:

有人知道出了什么问题吗?

Does anyone know what went wrong?

推荐答案

我想通了.schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod 声明的 URI 应使用 http.不是 https.

I figured it out. The URI for the schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod claim should use http. Not https.

你应该改变下面的行

if (pin == "12345")
        {
            System.Security.Claims.Claim claim = new System.Security.Claims.Claim("https://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "https://schemas.microsoft.com/ws/2012/12/authmethod/otp");
            claims = new System.Security.Claims.Claim[] { claim };
        }

到

if (pin == "12345")
        {
            System.Security.Claims.Claim claim = new System.Security.Claims.Claim("http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "https://schemas.microsoft.com/ws/2012/12/authmethod/otp");
            claims = new System.Security.Claims.Claim[] { claim };
        }

然后它就会起作用.

当我从 https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-build-custom-认证方法

我已经提交了https://github.com/MicrosoftDocs/windowsserverdocs/pull/4165 github 上的更正，应该很快就会提交.

I have submitted the https://github.com/MicrosoftDocs/windowsserverdocs/pull/4165 correction on github which should get committed soon.

这篇关于AD FS 自定义身份验证提供程序未返回身份验证方法声明的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！