How to add ADFS layer to existing Owin/OAuth authentication layer

Question

Currently, our system implements Owin and OAuth to authenticate and log in with the access token.

However, on top of that, I now need to add a first check with an existing ADFS authentication server. The current steps are

1. Use OAuth to verify and log in, returning the ticket.

Now, I need to incorporate ADFS so that the steps are...

1. Connect to ADFS server and authenticate.
2. If pass, grab details from own server and proceed authenticated with token.
3. If fail because some users won't exist in ADFS, check for user from own server and if found and authenticated, proceed as before.

I am trying two separate possibilities:

1. In Startup.Auth.cs, I added WsFederationAuthenticationOptions for ADFS using the metadataaddress. I am stuck on how to actually use Wreply and Wtrealm and then how to then proceed to check our own OAuth authentication.

2. Thinking maybe I don't need to do it there, I am modifying the class Application OAuthProvider and in "GrantResourceOwnerCredentials" I am trying to just manually connect to ADFS in there, send the verification details there, grab a response, and proceed based off of the response.

Am I proceeding about this the wrong way? Are the two attempts I'm trying on the right track, and if so, how do I connect that way and return to complete the necessary steps?

Answer 1

Take a look at IdentityServer - in particular version 3 and documentation.

You'll see how it handles multi-auth.

You authenticate with ADFS and get a set of claims back. If the user is not in AD, you will stay on the ADFS login screen with error.