AD FS定制身份验证提供程序未返回身份验证方法声明

Question

我为AD FS MFA制作了自定义身份验证提供程序。

我已经在元数据中定义了身份验证方法声明：

public string[] AuthenticationMethods
{
    get { return new string[] { "https://schemas.microsoft.com/ws/2012/12/authmethod/otp" }; }
}

我也有一个TryEndAuthentication方法（这仅用于实验室目的，一旦这部分工作，我将更改硬编码的引脚：]

 public IAdapterPresentation TryEndAuthentication(IAuthenticationContext context, IProofData proofData, System.Net.HttpListenerRequest request, out System.Security.Claims.Claim[] claims)
    {
        claims = null;
        IAdapterPresentation result = null;
        string pin = proofData.Properties["pin"].ToString();
        if (pin == "12345")
        {
            System.Security.Claims.Claim claim = new System.Security.Claims.Claim("https://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "https://schemas.microsoft.com/ws/2012/12/authmethod/otp");
            claims = new System.Security.Claims.Claim[] { claim };
        }
        else
        {
            result = new AdapterPresentation("Authentication failed.", false);
        }
        return result;
    }

但是当我在我的AD FS中部署它时，当我正确登录时会出现此错误：

有人知道出了什么问题吗？

Answer 1

我知道了。 schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod声明的URI应使用http。不是https。

您应该在行下方更改

if (pin == "12345")
        {
            System.Security.Claims.Claim claim = new System.Security.Claims.Claim("https://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "https://schemas.microsoft.com/ws/2012/12/authmethod/otp");
            claims = new System.Security.Claims.Claim[] { claim };
        }

to

if (pin == "12345")
        {
            System.Security.Claims.Claim claim = new System.Security.Claims.Claim("http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "https://schemas.microsoft.com/ws/2012/12/authmethod/otp");
            claims = new System.Security.Claims.Claim[] { claim };
        }

然后它将起作用。

当我从https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method复制示例适配器代码时，我犯了同样的错误>

我已经在github上提交了https://github.com/MicrosoftDocs/windowsserverdocs/pull/4165更正，应尽快提交。