How do I expose WS-Federation metadata on ASP.NET MVC 5?

1
votes

I have a SAAS app built with ASP.NET MVC 5 and I've several clients accessing my app through forms authentication and that works fine, but one of my clients that is a big enterprise company, required me to implement single sign-on. I'm not sure what do I need to install/implement on my side. This client required the use of federation, it must be implemented via industry standard WS-Federation and I have to expose WS-Federation Metadata via a web protocol endpoint to be accessible by their IDP. They also required the use of SAML 2.0 HTTP Artifact Binding.

2
c#asp.net-mvc-5single-sign-onsaml-2.0ws-federation

2 Answers

1
votes

Typically, you only need to generate the metadata once and then make it available to the IdP either via a URL or as an XML file. The metadata will contain information about your SP, such as audience, redirect URL, what assertions you require, certificate keys, etc. The idea is that the person setting it up on the IdP side does not have to enter them manually and can simply import the metadata; this also saves them from updating the settings for your SP if anything changes (e.g. your certificate keys). But, configuring WS-Federation (within ADFS on their side, I assume) is possible if you can convince them that seting up the metadata will be a big endeavour. The three basic pieces of information that you need to provide them are:

  • Your realm (an identifier for your SP)
  • Your reply URL (where the IdP will post-back the SAML)
  • The assertions that you want in the SAML (username, email address, etc.)

You can also use an online tool to generate a one-off metadata that you can then host on your site or share with the IdP by email.

1
votes

So you are acting as an IDP?

You would either use WS-Fed or SAML 2.0. You would not use both.

For both protocols, you need a server side stack.

Not aware of any WS-Fed server side stack but for SAML you could use the one from ComponentSpace. That supports artifact binding.

Be aware that this is the most difficult SAML binding to get working since it requires an out-of-band SOAP connection as well.

Ask if they support HTTP Post or Redirect bindings?

Your other alternative is to use something like Auth0 or Okta.