MSAL.Net connecting to Azure AD federated with ADFS

Question

We are building applications in ASP.Net MVC and Web API that use a range of OAuth 2 features - AcquireTokenByAuthorizationCode (using microsoft.identity.web), AcquireTokenSilently, AcquireTokenOnBehalfOf, AcquireTokenForClient for different parts of the application landscape.

The applications use MSAL.Net to interact with Azure AD and users provisioned in it to provide access to resources and that works ok.

We are now looking at building a connect back to the organization's on-prem maintained user accounts so the end users are not duplicated in AAD and on prem, so ADFS maintained in the org is an option. Considering the ADFS instance to be 2016, the one option to have MSAL.Net work with ADFS appears to be having Azure AD federated with ADFS as explained in this article: https://docs.microsoft.com/bs-latn-ba/azure/active-directory/develop/msal-net-adfs-support

The article only discusses AcquireTokenInteractive and I do not see explanation that other MSAL.Net operations are supported on having AAD federated with ADFS. I would assume that is true, and we have to run through our tests after we have it all configured, but meanwhile,

would anyone have any experience or documentation around having the range of operations with MSAL.Net (and even msal.js) and AAD work OK when AAD is federated with ADFS?

Praveen Nayak Praveen Nayak · Accepted Answer · 2020-04-06T03:01:41

So I went ahead and tried this for myself, setting a VM up in Azure, installed Active Directory, AD FS and configured the federation between Azure AD and the VM AD FS as per the article https://docs.microsoft.com/en-us/azure/active-directory/b2b/direct-federation-adfs.

Then validated the different OAuth features used by our application, specifically (I would expect other oauth features to work as expected too based on the below observations):

AcquireTokenByAuthorizationCode
AcquireTokenSilently
AcquireTokenOnBehalfOf
AcquireTokenForClient

All these feature work as expected. The user is redirected to org login page and redirected back to the application.

A couple of observations along the way

The refresh token lifetime is 12 hours when working with On premise AD credentials integrated via ADFS instead of the few days when user is provisioned in AAD. This is apparently to mitigat the risk of user information changing e.g. password change. If the browser is idle for > 12 hours, re-login by the user is required.
Once authenticated, further OAuth operations do not involve On prem AD / ADFS. The operations are against Azure AD, any browser redirects are to Azure AD for re-auth.

MSAL.Net connecting to Azure AD federated with ADFS

1 Answers