authenticate Angular 2 against ADFS via Web API

1
votes

I have an angular 2 app, a Web API with OWIN Pipeline (.NET 4.6) and an ADFS 3.0. Every user who uses the angular 2 app needs to be authenticated and authorized via ADFS and if he's already logged in the domain he should be logged in to the Application automatically (Single Sign On)

Something like that:

enter image description here

I read tons of links and code on how to achieve that but I fail to put the pieces together. As far as I understand ADFS 3.0 only supports OAuth 2 Authorization Code Flow which is either not supported or advised with a JS Application respectively on the Web per se. I'm not quite sure which it is but the fact is I can't/shouldn't use it.

I understood that therefore I have to implement somekind of Authentication server on my Webserver where my Web API is (maybe IdentityServer 3 or something "homemade").

This lead me to think that I should use ADFS as an external login like google, or facebook which would lead to the following workflow

  1. User requests token
  2. Web API checks if user is already logged in to the domain
  3. Logged in?
    1. forward request to ADFS and verify.
    2. ADFS returns OAuth Token to WebAPI
  4. not logged in?
    1. show login mask to user
    2. forward request to ADFS and verify.
    3. ADFS returns OAuth Token to WebAPI
  5. Web API return OAuth Token to user

Is this even correct or am I completly off?

Anyway I fail to put the pieces to together. I saw a lot of code which creates JWT Tokens in Web API (but doesn't communicate with ADFS) or communicates with ADFS via WS-Federation. Additionally ADFS' OAuth 2 implementation seems to a bit special which adds another layer of complexity.

so my question would be:

How can I provide OAuth tokens to the user while authenticating against ADFS?

If you need any additional information I happily provide it

1
asp.net-web-apioauth-2.0owinadfs

1 Answers

1
votes

You will need ADFS 2016 which supports Single Page Apps that use Angular.JS. See https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-fs/development/single-page-application-with-ad-fs for the flow and sample code.

You are right that ADFS 2012R2 only support authorization code flow which is only meant for native apps which are public clients to talk to a web api.

Thanks

//Sam (Twitter: @MrADFS)