Owin / Mvc add support for bearer token authentication

Question

My objective is to have an Asp.Net Mvc action secured with OpenId authentication, and support 2 types of clients: browser and a native WPF application. The STS I will use is ADFS 2016.

Currently clients browsers works well. For this, I have UseOpenIdConnectAuthentication configured in my startup class. I'm able to call my Mvc action (secured with Authorize attribute), user is redirected to STS, and once authentication is done, I come back to my Mvc action with a ClaimsIdentity properly filled.

Now I'm trying to have a native WPF app able to authenticate to the same Mvc action in the same Web app, and things are getting tricky. On the client side (my WPF application), I'm using ADAL and the following code:

        var authContext = new AuthenticationContext("<MySTSUri>");

        var authResult = await authContext.AcquireTokenAsync(
                             "http://localhost:1276/openid/login",
                             "MyNativeAppId",
                             new Uri("myapp://openid"),
                             new PlatformParameters(PromptBehavior.Auto),
                             UserIdentifier.AnyUser,
                             "");

        if (!string.IsNullOrEmpty(authResult.AccessToken))
        {
            using (var httpClient = new HttpClient())
            {
                httpClient.DefaultRequestHeaders.Authorization =
                    new AuthenticationHeaderValue(authResult.AccessTokenType, authResult.AccessToken);

                HttpResponseMessage response = await httpClient.GetAsync("http://localhost:1276/openid/login");

                if (response.IsSuccessStatusCode)
                {
                    var text = await response.Content.ReadAsStringAsync();
                }
            }
        }

The problem is basically that I can't tell the Web app to be able to validate this type of ADAL request.

I've tried various things in the Web application Owin startup file configuration:

leaves UseOpenIdConnectAuthentication: it doesn't seem sufficient, I'm redirected to STS with the ClientId of the Web application
UseActiveDirectoryFederationServicesBearerAuthentication api since I know my STS will always be an ADFS
UseOAuthBearerAuthentication

None of them are working.

Please can someone help how to achieve this? Am I going in the right direction?

Any ideas/pointers would be greatly appreciated.

Thanks, Alex

Alexandre Defalque Alexandre Defalque · Accepted Answer · 2018-02-06T07:59:38

I've managed to get it working. I post the answer for the record.
What helped me a lot is to enable Owin logs in the web.config:

  <system.diagnostics>
    <switches>
      <add name="Microsoft.Owin" value="Verbose" />
    </switches>
  </system.diagnostics>

Then with Owin, you can simply chain multiple authentication methods. So in my case, I've just used:

app.UseActiveDirectoryFederationServicesBearerAuthentication(
                new ActiveDirectoryFederationServicesBearerAuthenticationOptions
                {
                    MetadataEndpoint = adfsMetadataEndpoint,
                    TokenValidationParameters = new TokenValidationParameters()
                    {
                        ValidAudiences = new[] { validAudience }
                    }
                });

app.UseCookieAuthentication(new CookieAuthenticationOptions()
            {
                AuthenticationType = "Cookies"
            });

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions()
            {
                AuthenticationType = "OpenId",

                ClientId = clientId,
                Authority = authority,
                RedirectUri = redirectUri,

                ResponseType = OpenIdConnectResponseTypes.CodeIdToken,

                Scope = "openid",

                SignInAsAuthenticationType = "Cookies"    
            });

Cheers,
Alex

Owin / Mvc add support for bearer token authentication

1 Answers