4

I am having an issue with properly configuring ValidatingIssuerNameRegistry in my ASP.NET Web Application. According to this article, I configured Azure AD sign-on to my app. Everything appears to work fine, but Visual Studio 2013 gives me a config warning (blue underline) on the configuration section for trustedIssuers so I decided to find a fix. This gentleman describes an alternative way of doing it that lines up with the VS2013 config warning. But alas, it does not work for me. IIS Express gives me an error when I try to run it.

Any thoughts on what I have mixed up? I'm guessing there is a version issue with .NET 4.5/4.0 or something of that nature but I can't find it.

This does not work... (Server Error: WIF10112: The only supported element inside 'issuerNameRegistry' is 'authority'. Found element 'trustedIssuers'.) NOTE: Bottom of error page reports:

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.34009

      <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">

    <trustedIssuers>
      <add name="[MYNAME]" thumbprint="[MYTHUMB]"/>

    </trustedIssuers>

  </issuerNameRegistry>

This does work, but gives a compile time warning (expected 'trustedIssuers')...

      <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
    <authority name="MYNAME">
      <keys>
        <add thumbprint="MYTHUMB" />
      </keys>
      <validIssuers>
        <add name="MYNAME" />
      </validIssuers>
    </authority>
  </issuerNameRegistry>

2 Answers 2

2

Visual Studio uses XSD schemas to validate the config as far as I am aware. They usually reside in a folder like C:\Program Files (x86)\Microsoft Visual Studio 11.0\Xml\Schemas

The schema for the ValidatingIssuerNameRegistry is (http://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.validatingissuernameregistry(v=vs.115).aspx):

<system.identityModel>
   <issuerNameRegistry type='derived from ValidatingIssuerNameRegistry'>
      <authority name='someFriendlyName'>
         <keys>
            <add thumbprint='caseInsensitiveString'/>
            <add symmetricKey='Base64Encoded bytes' />
         </keys>
         <validIssuers>
            <add name='issuer1'/>
            <add name='issuer2'/>
         </validIssuers>
      </authority>
   </issuerNameRegistry>
</system.identityModel>

The schema for the ConfigurationBasedIssuerNameRegistry is (http://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.configurationbasedissuernameregistry(v=vs.110).aspx):

<system.identityModel>
<identityConfiguration>
    <issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel">
        <trustedIssuers>
            <add thumbprint="thumbprint" name="name" />
        </trustedIssuers>
    </issuerNameRegistry>
</identityConfiguration>

It is likely the XSD files that visual studio uses only reference one or the other. The easiest way to find it is to search the XSD files for the string vs:help="configuration/system.identityModel/issuerNameRegistry"

You can update the schema if you wish so you no longer get the blue underlined text. I'm only using Visual Studio 2012 so I can't confirm this will work for you.

1
  • Thanks! I ended up using the ConfigurationBasedIssuerNameRegistry method because it is inline with .NET 4.5. No need to change the XSD schema but good to know it's there for future reference. Cheers.
    – IntStarFoo
    Sep 2, 2014 at 15:00
1

I think I figured out the issue but I'm not sure why. For some reason, the system must be picking up a previous version of "System.IdentityModel.Tokens.ValidatingIssuerNameRegistry". If you can explain why, I'll be happy to mark you as answer.

<issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
  <trustedIssuers>
    <add name="[MYNAME]" thumbprint="[MYTHUMB]"/>
  </trustedIssuers>
</issuerNameRegistry>

Should Be...

<issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
  <trustedIssuers>
    <add name="[MYNAME]" thumbprint="[MYTHUMB]"/>
  </trustedIssuers>
</issuerNameRegistry>
1
  • Did you find out what the actual difference is between these? Is one better than the other or is one of them newer? Just want to know when to choose what and what it will affect in my application.
    – Niklas
    Sep 23, 2015 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.