[Announcement] WsFederation 2.0.0-preview1 out of band release

[Tratcher]

WsFederation preview support is now available for ASP.NET Core 2.0.0. The Microsoft.AspNetCore.Authentication.WsFederation 2.0.0-preview1 package is available at https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.WsFederation/. This is a standalone preview that targets netstandard2.0 and should work with existing ASP.NET Core 2.0.0 applications (.NET Core 2.0 or .NET 4.6.1). A non-preview ASP.NET Core 2.0.0 compatible package will follow once we’ve addressed your feedback.

The code is available at https://github.com/aspnet/security/tree/rel/2.0.0-ws-preview1 and issues can be filed at https://github.com/aspnet/security/issues. Please give us a 👍 from the reactions menu on this post if you have successfully used this component and are ready for the final release.

This component is a port from Microsoft.Owin.Security.WsFederation and uses many of the same mechanics. It has also been updated to integrate with ASP.NET Core 2.0’s authentication model. See the samples below.

Aside from updating the usage pattern to match ASP.NET Core, there are also some functional changes to be aware of.
A. This component no longer checks every form post request for sign-in messages by default. Sign-in callbacks are restricted to the "/signin-wsfed" path by default. The CallbackPath can be changed to the application root “/” used by some auth providers if you also enable SkipUnrecognizedRequests to allow sharing that request path with other components.
B. This component no longer allows unsolicited logins by default. That WsFederation protocol feature is susceptible to XSRF attacks. See the AllowUnsolicitedLogins option to opt into that feature if your application requires it.

Samples:

For applications only using WsFederation (similar to using OpenIdConnect):

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(sharedOptions =>
        {
            sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            sharedOptions.DefaultChallengeScheme = WsFederationDefaults.AuthenticationScheme;
        })
        .AddWsFederation(options =>
        {
            options.Wtrealm = Configuration["wsfed:realm"];
            options.MetadataAddress = Configuration["wsfed:metadata"];
        })
        .AddCookie();
    }

    public void Configure(IApplicationBuilder app)
    {
       app.UseAuthentication();

                     // …
    }

For applications using WsFederation with Identity:

        services.AddAuthentication()
            .AddWsFederation(options =>
            {
                options.Wtrealm = Configuration["wsfed:realm"];
                options.MetadataAddress = Configuration["wsfed:metadata"];
            });

[ashgadala]

Wonderful....! Yay...!

[gtresoldi]

Hi,
I've tried to use WsFederation with ADFS server 2016. Here my configuration:

services.AddAuthentication() .AddWsFederation(options => { options.Wtrealm = "https://localhost:44312"; options.MetadataAddress = "https://adfsserver2016/FederationMetadata/2007-06/FederationMetadata.xml"
I get this exception.
Exception.txt

This is my metadata file
FederationMetadata.txt

Anyone can help me?
Thanks

[Compufreak345]

I've got the same issue like @gtresoldi with an ADFS on Windows Server 2012 R2

Hi,
I've tried to use WsFederation with ADFS server 2016. Here my configuration:

services.AddAuthentication() .AddWsFederation(options => { options.Wtrealm = "https://localhost:44312"; options.MetadataAddress = "https://adfsserver2016/FederationMetadata/2007-06/FederationMetadata.xml"
I get this exception.
Exception.txt

This is my metadata file
FederationMetadata.txt

Anyone can help me?
Thanks

Should we file a seperate issue for this problem or is there any other solution?

Thanks & best regards,
Christoph

[Tratcher]

@gtresoldi @Compufreak345 I've filed AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#786 for your parser issue.

[ashgadala]

@Tratcher FYI. same parser issue as above.

[lolofx]

Great news :)

[reicher001]

@Tratcher Looks like I am getting the same parser issue too.

[Zoxive]

Any timeline for wsignoutcleanup1.0 support?

[Tratcher]

@Zoxive this one? #1425.
We're considering it but there's no specific timeline. The current focus is porting over existing functionality from Katana.

[Zoxive]

@Tratcher Kinda, when our single signon provider wants to sign out all the sub applications each application gets a SignoutCleanup action

For now im doing something like this inside the WsFederationHandler HandleRemoteAuthenticateAsync

 // Handle SignoutCleanup
if (Request.Query.TryGetValue("wa", out var wa))
{
    if (wa == WsFederationConstants.WsFederationActions.SignOutCleanup)
    {
        await _authenticationService.SignOutAsync(Request.HttpContext, Options.SignInScheme, null);
        return HandleRequestResult.Handle();
    }    
}

You could do something similar with middleware etc, but we already have a custom WsFederation fork to support dotnetcore. (soon as all features are met we can remove our custom proj)

[Tratcher]

@Zoxive how is that different from #1425? That sounds like what we'd implement. OIDC has something similar.

[jmezach]

Is there any guidance on how we could share FedAuth cookies between existing ASP.NET full framework applications and ASP.NET Core apps? As far as I can see this just enables an ASP.NET Core application to authenticate against a WSFed STS. We are looking for a way to re-use existing FedAuth cookies so that we can move part of our applications to ASP.NET Core without having to rewrite existing code.

[Tratcher]

@jmezach It depends on what components your ASP.NET apps were using. If it was the Microsoft.Owin WsFederation provider then there is a way to share cookies.
https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/compatibility/cookie-sharing

[arc2018]

I get this error when I start the application. it is not able to complete the configuration from Federation Metadata. if I enter the metadata url on the browser I am able to see the xml, but only issue I see is that there is a certificate error, which I override on the browser. would that be an issue causing this?

my config:

 public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc();
            services.AddAuthentication(sharedOptions =>
                        {
                            sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                            sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                            sharedOptions.DefaultChallengeScheme = WsFederationDefaults.AuthenticationScheme;
                        })
                       .AddWsFederation(options =>
                       {
                           options.Wtrealm = @"http://localhost:3230/";// Configuration["wsfed:realm"];
                           options.MetadataAddress = @"https://DevIDPServer/sts/Metadata.xml";// Configuration["wsfed:metadata"];
                       })
                       .AddCookie();

        }

app.UseAuthentication();

----------------------Errors-----------------------------

System.InvalidOperationException: IDX10803: Unable to obtain configuration from: 'https://DevIDPServer/sts/Metadata.xml'. ---> Microsoft.IdentityModel.Xml.XmlReadException: IDX13004: Security token type role descriptor is expected.
   at Microsoft.IdentityModel.Protocols.WsFederation.WsFederationMetadataSerializer.ReadEntityDescriptor(XmlReader reader)
   at Microsoft.IdentityModel.Protocols.WsFederation.WsFederationMetadataSerializer.ReadMetadata(XmlReader reader)
   at Microsoft.IdentityModel.Protocols.WsFederation.WsFederationConfigurationRetriever.<GetAsync>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.<GetConfigurationAsync>d__24.MoveNext()
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.<GetConfigurationAsync>d__24.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.WsFederation.WsFederationHandler.<HandleChallengeAsync>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.<ChallengeAsync>d__53.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Authentication.AuthenticationService.<ChallengeAsync>d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.ChallengeResult.<ExecuteResultAsync>d__14.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeResultAsync>d__19.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeFilterPipelineAsync>d__17.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeAsync>d__15.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Builder.RouterMiddleware.<Invoke>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext()

[Tratcher]

@arc2018 yes https cert errors are expected to fail the metadata download. However, that's a strange inner exception. I've ask @brentschmaltz about it on your other thread:
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#804

To ignore cert errors you need to hook into the backchannel like this:
options.BackchannelHttpHandler = new HttpClientHandler() { ServerCertificateCustomValidationCallback = (_, __, ___, ___) => true };

[arc2018]

@Tratcher thank you for your response.
I added the BackchannelHttpHandler, but that did not make any difference, I get the same error.
this is the new code:
`public void ConfigureServices(IServiceCollection services)
{
services.AddMvc();
services.AddAuthentication(sharedOptions =>
{
sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
sharedOptions.DefaultChallengeScheme = WsFederationDefaults.AuthenticationScheme;
})
.AddWsFederation(options =>
{
options.Wtrealm = @"http://localhost:3230/";// Configuration["wsfed:realm"];
options.MetadataAddress = @"https://DevIDPServer/sts/Metadata.xml";// Configuration["wsfed:metadata"];
options.BackchannelHttpHandler = new HttpClientHandler() {
ServerCertificateCustomValidationCallback =
(req, cert, er, t) =>
true
};
})
.AddCookie();

    }

`
I created a test full framework 4.5 asp.net web app pointing to the same IDP and it works without any issue on the same machine. here is my web config on the 4.5 application. We are using SecureAuth as our identity provider.

<system.identityModel> <identityConfiguration> <audienceUris> <add value="http://localhost/testAuth/" /> </audienceUris> <certificateValidation certificateValidationMode="None" /> <issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"> <trustedIssuers> <add thumbprint="22 33 s3 57 cd aa d3 a3 07 ea 32 7s e6 b9 ec e3 84 7d 91 34" name="https://DevIDPServer/sts/" /> </trustedIssuers> </issuerNameRegistry> </identityConfiguration> </system.identityModel> <system.identityModel.services> <federationConfiguration> <cookieHandler requireSsl="false" hideFromScript="true" persistentSessionLifetime="1:2:0" /> <wsFederation passiveRedirectEnabled="true" persistentCookiesOnPassiveRedirects="true" issuer="https://DevIDPServer/sts/" realm="http://localhost/testAuth/" reply="http://localhost/testAuth/" requireHttps="false" /> </federationConfiguration> </system.identityModel.services>

[Tratcher]

Please reopen you AzureAd bug then. They can investigate the exception.

[arc2018]

@Tratcher thank you. I reopened it.

[lzandman]

I'm getting a similar issue as @arc2018. Is it possible to bypass the metadata XML file retrieval and configure this thing manually?

[Tratcher]

Yes you can set the options.Configuration property, but building it by hand is non trivial. If you manage please share a sample.

[Zoxive]

@Tratcher @lzandman
Not to bad for us. This is what we use.

// Created our own custom WsFederationSettings dto
public class WsFederationSettings
{
    public string Issuer { get; set; }
    public string TokenEndpoint { get; set; }
    public IEnumerable<string> SigningKeys { get; set; }
    public string Realm { get; set; }
}

// Load from section "WsFederation" in our appsettings.json file
var settings = Configuration.GetSection("WsFederation").Get<WsFederationSettings>();

var config = new WsFederationConfiguration
{
    Issuer = settings.Issuer,
    TokenEndpoint = settings.TokenEndpoint,
};
foreach (var signKey in settings.SigningKeys)
{
    var cert = new X509Certificate2(Convert.FromBase64String(signKey));

    var key = new X509SecurityKey(cert);
    config.SigningKeys.Add(key);
}
o.Configuration = config;
o.Wtrealm = settings.Realm;
o.TokenValidationParameters = new TokenValidationParameters
{
    ValidAudience = settings.Realm
};
///rest of your options

[lzandman]

Thanks @Tratcher @Zoxive. Will try!

[Jeeves8]

I'm new to ADFS, I'm trying to configure my application using the WsFederation 2.0.0-preview2.
The app is redirecting to the ADFS URL as expected but for some reason i'm getting error after I enter my login credentials.

The same ADFS config works with ASP.NET web app using WIF
https://docs.microsoft.com/en-us/dotnet/framework/security/how-to-build-claims-aware-aspnet-mvc-web-app-using-wif

Could someone please share a complete working example using WsFederation 2.0.0-preview2.

Its a .Net Core SPA, All I wanted to do is to allow users with valid token, its very simple application and there's no sign out page.

[KoalaBear84]

Sorry.. I didn't use Wreply, it's SignOutWreply. I don't know if that is almost the same.

[Tratcher]

SignOutWreply works but may be confusing when it defaults to Wreply, which defaults to CallbackPath.

[andyong79]

Thanks @Tratcher that worked a treat for setting the whr value.

        .AddWsFederation(options =>
        {
            options.Wtrealm = ...                
            options.MetadataAddress = ...
            options.Wreply = ...
            options.Events.OnRedirectToIdentityProvider = OnRedirectToIdentityProvider(config.GetValue<string>("HomeRealm"));
        })

private static Func<RedirectContext,Task> OnRedirectToIdentityProvider(string whrValue)
{
return ctx =>
{
if (!string.IsNullOrEmpty(whrValue))
{
ctx.ProtocolMessage.Whr = whrValue;
}
return Task.CompletedTask;
};
}

[Tratcher]

https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.WsFederation/2.0.0 is now available. Enjoy 😀

[fitzchak]

@Veikedo is there a way to let SpaAuthMiddleware be aware of AllowAnonymousAttribute?

[viktor-nikolaev]

@fitzchak I think you don't need it because it should be implemented on the client side.
What is your case?

[fitzchak]

@Veikedo I have a regular account/login action which should be accessible. I solved this by changing the middleware to authenticate just the static related info, so regular MVC would be authenticated against the existing authentication.

[mshindal]

I'm getting the same endless loop bug as @epot, did you ever find a fix?

[Tratcher]

@mshindal please open a new issue and share your Startup config and a Fiddler trace.

[mshindal]

@Tratcher #1671

[epot]

@mshindal no I am still stuck, this prevents me from migrating for the moment

[locutus80]

I'm getting stuck in a redirect loop when using the 2.0.3 version of the WsFederation package. Everything works fine loading the site in a normal browser, but we get stuck in the loop when using the site in an IFRAME (unfortunately, I have to do this, long story).

Looking at the server, requests are logged with "Authorization failed for user: (null)"
On the client side I can see repeated 302 redirects which eventually stop after 4-5 attempts

[Tratcher]

@locutus80 please open a new issue with the details. A fiddler trace, Startup code, etc..

[ready1]

I'm a little stuck with the Events, the only event that works for me is OnRedirectToIdentityProvider but after a successful login, OnSecurityTokenValidated, OnMessageReceived, OnTicketReceived never gets called. Is there a setting that I am missing or is there a different way to set up the handlers?

Here is my set up code.

services.AddAuthentication(sharedOptions =>
{
sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
sharedOptions.DefaultChallengeScheme = WsFederationDefaults.AuthenticationScheme;
})
.AddWsFederation(options =>
{
options.Wtrealm = stsRealm;
options.Wreply = stsReplyTo;

            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateAudience = true,
                ValidAudience = stsRealm,
                ValidateIssuer = true,
                ValidIssuer = stsIssuer,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = stsPublicKey
            };

            options.Configuration = new WsFederationConfiguration
            {
                Issuer = stsIssuer,
                TokenEndpoint = new Uri(stsEndpoint, stsSignInPath).ToString(),
                SigningKeys =
                {
                    stsPublicKey
                }
            };

            options.Events = new WsFederationEvents
            {
                OnRedirectToIdentityProvider = notifications =>
                {
                    // this gets called
                    var i = 0;
                    return Task.CompletedTask;
                },
                OnSecurityTokenValidated = context =>
                {
                    // this NEVER gets called
                    var i = 0;
                    return Task.CompletedTask;
                },
                OnMessageReceived = context =>
                {
                    // this NEVER gets called
                    var i = 0;
                    return Task.CompletedTask;
                },
                OnTicketReceived = context =>
                {
                    // this NEVER gets called
                    var i = 0;
                    return Task.CompletedTask;
                }
            };
        })
        .AddCookie();

Regards,
J

[Tratcher]

@ready1 I copied your events code into my sample in dev https://github.com/aspnet/Security/tree/dev/samples/WsFedSample and it worked fine, all the events were hit. I double checked the 2.0 code and I don't think anything has changed since then. Nor should your custom config or TVP settings affect this. I assume you ran it locally under the debugger?

[ready1]

@Tratcher Thank you for your response, I am running locally under debugger but it is not doing what is expected with the callback. Could this problem be caused by the endpoint? How can I pinpoint what causing the callback not to be called?

[Tratcher]

Do you have UseAuthentication in your Startup.Configure method? In what order?

[ready1]

@Tratcher We have found that the callback only triggers if the replyto ends with '/signin-wsfed' and not '/'
Thanks for your help.

[AnshulKhandelwal02]

I am stuck with getting auth token for webapi authentication, using wsfed.
I have achieved same with openId Connect, wherein post webapp authentication I am using context.ProtocolMessage.Code in OnAuthorizationCodeReceived event to get token for my web api silently.

OnAuthorizationCodeReceived = async context =>
{
	var request = context.HttpContext.Request;
	var currentUri = UriHelper.BuildAbsolute(request.Scheme, request.Host, request.PathBase, request.Path);

	var credential = new ClientCredential(ClientId, ClientSecret);
	var authContext = new AuthenticationContext(Authority);

	var result = await authContext.AcquireTokenByAuthorizationCodeAsync(
		context.ProtocolMessage.Code, new Uri(currentUri), credential, Resource);

	context.HandleCodeRedemption(result.AccessToken, result.IdToken);
}

I need to have both Open Id and WsFed integrated, with same behaviour. Tried with OnSecurityTokenReceived as well as OnTicketReceived events, but not able to get auth code or token for web api authentication. Need above behaviour in one of these places, but not getting where !!

OnSecurityTokenReceived = async context =>
{
	Log.Information("WsFed : OnSecurityTokenReceived");
},
OnSecurityTokenValidated = context =>
{
	Log.Information("WsFed : OnSecurityTokenValidated");
	return Task.CompletedTask;
},
OnTicketReceived = context =>
{
	Log.Information("WsFed : OnTicketReceived");
	return Task.CompletedTask;
},

I am getting claims in OnTicketRecieved with context.Principal.Identity.
Using OnSecurityTokenReceived I am not getting claims either. But I guess I will use OnTicketRecieved for that. But for webApi authentication, I need to have similar mechanism in place.

Has anyone done this before ? Or can anyone please help ?

[brentschmaltz]

@AnshulKhandelwal02 for wsfed, you will receive a token directly. The OnTicketReceived has the details.
redeeming a 'code' is not a wsfed protocol behavior, it is an OAuth / OIDC behavior.

[AnshulKhandelwal02]

@brentschmaltz yes, achieved that with code.

[AnshulKhandelwal02]

Still the issue I am facing is to get webApi authenticated with bearer token received from web authentication.

1. Created web app, Angular template of .net core 2.1. Aded WsFed authentication to it. https://demoapp
2. Created Web Api app. Added wsfed authentication to it. https://demoapp-api
3. Now target is to authenticate web app, use token from there to make calls to api, and get data.
4. In WebApp, in OnTicketReceived WsFederationEvent, acquiring token using AcquireTokenAsync(AppId, credential);
5. Passing this token as Bearer token in header to API.
6. When hitting API, facing redirection for authentication.
7. Ideally, when sending token, it should be allowed, right ?

I have added permissions of WebAPI on WebAPP in Azure portal, and also vice-versa.
Acquiring token using AppSecret.

Am I missing something here ? Or I am trying to achieve something which is not possible with WsFed ?
Can anyone please help with this webapp-webapi-wsfed scenario ?

[aspnet-hello]

We periodically close 'discussion' issues that have not been updated in a long period of time.

We apologize if this causes any inconvenience. We ask that if you are still encountering an issue, please log a new issue with updated information and we will investigate.