此部落格為測試SharePoint與OAuth2.0服務的整合，背景為埃維諾為某大型企業提供SharePoint門戶以及整個微服務平臺的解決方案,搭建了基於OAuth2.0的SOO。

在https://download.csdn.net/download/xiaomifengmaidi1/10779540下載程式碼 ，然後做一下修改

public class Config {
    public static List<IdentityResource> GetIdentityResources() {
        return new List<IdentityResource> {
            // The sub/nameid claim
            new IdentityResources.OpenId(),
 
            // All claim for user profile info (think name, email, etc.)
            new IdentityResources.Profile()
        };
    }
 
    public static List<Client> GetClients() {
        return new List<Client> {
            new Client {
                // The realm of your RP
                ClientId = "urn:sharepoint",
 
                // Required for ws-fed clients
                ProtocolType = IdentityServerConstants.ProtocolTypes.WsFederation,
 
                // Trust uri of your SharePoint web application (web app, appended with _trust/default.aspx)
                RedirectUris = { "http://SPServer/_trust/default.aspx" },
 
                // SAML token lifetime (in seconds)
                IdentityTokenLifetime = 36000,
 
                // Links to configured resources
                AllowedScopes = {"openid", "profile"}
            }
        };
    }
 
    public static List<RelyingParty> GetRelyingParties() {
        return new List<RelyingParty> {
            new RelyingParty {
                // Same as ClientId. Used to link config
                Realm = "urn:sharepoint",
 
                // SAML 1.1 token type required by SharePoint
                TokenType = WsFederationConstants.TokenTypes.Saml11TokenProfile11,
 
                // Transform claim types from oidc standard to xml types
                // Only mapped claims will be returned for SAML 1.1 tokens
                ClaimMapping = new Dictionary<string, string> {
                    {JwtClaimTypes.Subject, ClaimTypes.NameIdentifier},
                    {JwtClaimTypes.Email, ClaimTypes.Email}
                },
 
                // Defaults
                DigestAlgorithm = SecurityAlgorithms.Sha256Digest,
                SignatureAlgorithm = SecurityAlgorithms.RsaSha256Signature,
                SamlNameIdentifierFormat = WsFederationConstants.SamlNameIdentifierFormats.UnspecifiedString
            }
        };
    }
}
 

Users加上如下程式碼

public static List<TestUser> GetUsers() {
    return new List<TestUser> {
        new TestUser {
            SubjectId = "B9734696-5CC4-45FC-8674-C9340449D082",
            Username = "ids4",
            Password = "password",
            Claims = new List<Claim> {new Claim(JwtClaimTypes.Email, "
 
[email protected]"}
        }
    };
}

在startup中加入如下程式碼

public void ConfigureServices(IServiceCollection services) {
    services.AddMvc();
 
    services.AddIdentityServer()
        .AddSigningCredential("CN=ScottBrady91")
        .AddInMemoryIdentityResources(Config.GetIdentityResources())
        .AddInMemoryClients(Config.GetClients())
        .AddTestUsers(Config.GetUsers())
        .AddWsFederation()
        .AddInMemoryRelyingParties(Config.GetRelyingParties());
}
 
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory) {
    app.UseDeveloperExceptionPage();
 
    app.UseIdentityServer();
 
    app.UseStaticFiles();
    app.UseMvcWithDefaultRoute();
}
 

然後將其釋出出去

接下來就是配置SharePoint了，其實和配置ADFS差不多

$realm = "urn:sharepoint"
$identityProviderUrl = "http://ssox.azurewebsites.net/wsfederation"
$rootCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\devroot.cer")
New-SPTrustedRootAuthority -Name "Token Signing Cert Root" -Certificate $rootCert
$signingCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\pub.cer")
New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $signingCert
$nameIdClaimMap=New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" -IncomingClaimTypeDisplayName "NameId" -LocalClaimType "https://identityserver/name"
$emailClaimMap=New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Email" -SameAsIncoming

這裡需要注意的是有根證書的需要將根證書也要加入到SharePoint中,證書的操作可以將程式碼中的證書匯出公鑰證書

就配置好了，在手機上測試了下