Disabling encryption in Windows Identity Foundation

Question

Can I disable encryption of the request security token response and only manage signatures?

I'm creating a custom STS extending Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService based on the demos of the WIF SDK and I cannot manage to setup not using encryption.

No, assertions are encrypted by default using the encryption credentials configured. If i dont provide the info about certificates an exception is thrown. — elfebien, Apr 04 '11 at 14:32

score 0 · Answer 1 · answered Apr 05 '11 at 00:24

I create a CustomSecurityHandler and override its GetEncryptingCredentials method returning null value like the following lines and it works:

 public class MyCustomSecurityTokenHandler : Saml11SecurityTokenHandler
 {

    public MyCustomSecurityTokenHandler(): base() {}

    protected override EncryptingCredentials GetEncryptingCredentials(SecurityTokenDescriptor tokenDescriptor)
    {
        return null;
    }

 }

then in the SecurityTokenService class i override the GetSecurityTokenHandler returning the custom class created before:

protected override SecurityTokenHandler GetSecurityTokenHandler(string requestedTokenType)
    {
        MyCustomSecurityTokenHandler tokenHandler = new MyCustomSecurityTokenHandler();

        return tokenHandler;
    }

score 0 · Accepted Answer · edited May 02 '11 at 17:00

I just ran the "Add STS Reference" wizard in Visual Studio, selecting the option to create a new STS. The template that the tool generated does add support for token encryption, but if no cert is supplied, thne it is disabled: (I left all the default comments)

protected override Scope GetScope( IClaimsPrincipal principal, RequestSecurityToken request )
{
    ValidateAppliesTo( request.AppliesTo );

    //
    // Note: The signing certificate used by default has a Distinguished name of "CN=STSTestCert",
    // and is located in the Personal certificate store of the Local Computer. Before going into production,
    // ensure that you change this certificate to a valid CA-issued certificate as appropriate.
    //
    Scope scope = new Scope( request.AppliesTo.Uri.OriginalString, SecurityTokenServiceConfiguration.SigningCredentials );

    string encryptingCertificateName = WebConfigurationManager.AppSettings[ "EncryptingCertificateName" ];
    if ( !string.IsNullOrEmpty( encryptingCertificateName ) )
    {
        // Important note on setting the encrypting credentials.
        // In a production deployment, you would need to select a certificate that is specific to the RP that is requesting the token.
        // You can examine the 'request' to obtain information to determine the certificate to use.
        scope.EncryptingCredentials = new X509EncryptingCredentials( CertificateUtil.GetCertificate( StoreName.My, StoreLocation.LocalMachine, encryptingCertificateName ) );
    }
    else
    {
        // If there is no encryption certificate specified, the STS will not perform encryption.
        // This will succeed for tokens that are created without keys (BearerTokens) or asymmetric keys.  
        scope.TokenEncryptionRequired = false;            
    }

    // Set the ReplyTo address for the WS-Federation passive protocol (wreply). This is the address to which responses will be directed. 
    // In this template, we have chosen to set this to the AppliesToAddress.
    scope.ReplyToAddress = scope.AppliesToAddress;

    return scope;
}

Disabling encryption in Windows Identity Foundation

2 Answers2