ADFS openid-connect from web application without OWIN

2
votes

I have an existing web application that have a custom made authentication and login module. I would like to add login for some users via ADFS openid-connect but all examples I see is based on OWIN which I cannot use. My plan is to let some external users login via Azure AD and once they are authenticated in Azure I will create temporary users in the web application.

Can I use the ADAL framework or do I have to custom code all communication with Azure AD through the use of for example .Net HTTPClient ?

Thanks.

1
asp.netadfsopenid-connect
What is your exisiting web application built upon? ASP.NET MVC? You can probably not use HttpClient, as most authorization flows involve redirects of the end-users browser. – mode777
It's ASP.NET MVC. What I've gotten to work so far is to redirect the user to the login page and then redirect back to the web application together with an idtoken. I can also validate the idtoken using JwtSecurityTokenHandler. But I'm wondering if this is the way to go or if there are any frameworks I can use instead. I should also mention that I'm using ADFS, not AzureAD. – Johan
Which flow are you using? If you want to query user claims from ADFS' userinfo endpoint you will need an access token to do so. Sometimes the ID token will already contain the claims. If you already have an ID token and validated it, you've already come quite far on your own. The ID token will at least contain the user id ("sub") so this might be enough to create a local login. By the way: Apparently you can use OWIN alongside MVC4 so you may just use owin libraries:cloudidentity.com/blog/2014/07/28/… – mode777
UPDATE: According to the spec, if you haven't requested an Access Token, your claims should be included in the ID token already: The Claims requested by the profile, email, address, and phone scope values are returned from the UserInfo Endpoint, as described in Section 5.3.2, when a response_type value is used that results in an Access Token being issued. However, when no Access Token is issued (which is the case for the response_type value id_token), the resulting Claims are returned in the ID Token. – mode777
Hi, I can see that the claims are returned in the JWT token when I request an idtoken. The solution I've build so far is based on my custom code, would it be possible to use any framework such as ADAL for communication with ADFS without using OWIN? – Johan

1 Answers

1
votes

We implemented a solution with redirect to Azure AD login page and then a return URL back to the site and check for validity of the token.