Question

My current task is to secure a WCF service. The service is hosted using the configuration framework (5.5, released with the StockTraider sample) and the caller uses the configuration framework as well.

I managed to secure the connection using ws2007FederationHttpBinding.

For the “IsOnline()”-Check my STS issues a service token and this works already but for the actual service calls, I want to have ActAs-Tokens to still know the real user inside the called service.

My STS is capable of issuing the correct ActAs-Tokens.

The problem is the loadbalancing client, which always opens the factory and I cannot call the WIF-methods (ConfigureChannelFactory() and CreateChannelActingAs()) anymore, because they require the factory to be in the created state.

My best try is this, but it looses the ActAs-Subject somewhere and feels like a hack:

IPSServiceClient = new Client(serviceName, settingsInstance, createNewChannelInstance: true);

var token = ((IClaimsIdentity)Thread.CurrentPrincipal.Identity).BootstrapToken;

var factoryObject = IPSServiceClient.createANewChannelFactoryByAddress(IPSServiceClient.getANodeAddress());
var factory = factoryObject as ChannelFactory<IIWBPortalServiceV1>;
factory.ConfigureChannelFactory(); //factory must not be state=open here
factory.Credentials.SupportInteractive = false; //no cardspace

_channel = factory.CreateChannelActingAs(token);

Do I miss an extensibility point in the config framework? What is the best way I should go?

If I make a new console app, add service reference and add the two calls (ConfigureChannelFactory() and CreateChannelActingAs()) it just works!

Answer 1

The posted code inside my questions works. The problem was the web.config of the STS which was missing AudienceUris inside the ActAs-securityTokenHandlers section.

Still: The posted code feels like a hack to me.