We are going enhance the authentication and authorization system of our Intranet web app. After having few days reading about ADFS, STS, claim based authentication, asp.net Identity. Still not sure how these things works together.
Most of our intranet web applications are using Windows Integrated Authentication, we uses windows group or AzMan to do role base authorization. We have few applications(Vendor application) use it own user database and form base authentication.
We want to add following features to our web applications.
For Windows Authentication application, we want to let user to Sign Out / Sign in as different user. So when User A using his/her computer to access the application, it will auto logged in (default windows integrated authentication). When he/she do log out, it will redirect to a form to allow to input other user credential.
We want to allow user login to System A using System B username/password.
e.g. For the windows authentication application, we want allow user login to the application using the credential of the Form base application (Vendor application) of via visa
I don't know if ADFS can solve these two problems.
From my understanding, the main purpose of ADFS is to allow access to internal application from Internet, and it require SSL.
Our application all are in Intranet, and we don't want to manage the ssl cert.
But by using ADFS, perhaps I can enable both Windows and Form Authentication on my application, so then let use log out and re-direct him to the login form as which just like he access outside company network. It should solve the problem 1.
For problem 2, what if I can create a custom STS to issue security token by using the user database of the form base authentication appliaction. Then I can use claim based authentication and allow one application can use ADFS and my STS. It should solve my problem 2.
Is my direction correct? or am I complicated the problem?
ADFS will not work without SSL.
Furthermore, all RP have to use SSL.
Internally, users will be logged in seamlessly using WIA. When they logout, they will simply be seamlessly logged in again.
Also ADFS v3.0 and below can only authenticate against AD.
While what you want is possible using ADFS, the question is whether it's a good idea and worth the trouble. It may be more appropriate to ask the user to log out of the machine and log in with a different account so you can stick with Integrated Windows Authentication (IWA). Writing your own security infrastructure is fraught with peril.
If you really feel these are hard requirements and it is worth the trouble, the following may work.
Write an ASP.NET web application based on Katana and enable Integrated Windows Authentication. This will make sure that the first time a completely unauthenticated request comes in, the application will challenge the browser. Subsequent requests will have a WindowsPrincipal populated in the HttpContext.User and Thread.CurrentPrincipal.
Now, write a piece of OWIN middleware that checks if an authentication cookie is present. If the cookie is not present, it checks the Thread.CurrentPrincipal and serializes the claims into a secure cookie.
If the security cookie is present, it overwrites the WindowsPrincipal in Thread.CurrentPrincipal with a new ClaimsPrincipal created from the claims in the cookie.
Now, when a user navigates to the web application the first time, he/she will be logged in automatically using IWA and the cookie will be created. Now, provide a logout action which deletes the authentication cookie and presents the user with a username and password dialog.
In the POST handler for that action, use WIF to talk to the username endpoint in ADFS (using WS-Trust protocol) and try to authenticate the user with the supplied credentials. If successful, use the claims from the returned token to create a new authentication cookie.
We want to develop application for customer which uses LDAP for authentication makes it use for single sign on (SSO) technique.We are very beginner about this topic.
What we think about LDAP upto now is(Correct me if i am wrong):
There is LDAP server somewhere which contains users and its
associated role.
when user browse our web application it asks to enter username and
password (which is actually credentials for LDAP server)
when LDAP server authenticates it sends a token to our web
application ,we put that token in cookies and use this token to
authenticate users for every web application with in our domain.
so using this technique we do not have to make additional modules
for user management.
what we are missing ?
Any idea will be appreciated/
Thanks in Advance
I am developing an ASP.NET application. I have successfully added an STS reference to a stand-alone AD FS 2.0 server, so I can authenticate against a 3rd party's active directory. The problem is that I have more than one client who wishes to be able to authenticate against their own active directory. It seems that I can only add one STS reference to a project. How do I add multiple identity providers to an ASP.NET application and then programatically choose which provider I want to redirect the browser to for authentication? Thanks!
Ralphie
That's not the normal federation pattern.
You normally "bind" your application to one STS (say STS1) using FedUtil and then at the STS level federate with other STS (say STS2 and STS3). Then when the user accesses the application, WIF redirects to STS1 and you get a "Home Realm Discovery" screen that asks "Who would you like at authenticate against (STS1 / STS2 / STS3).
Your question doesn't indicate whether you already knew this or whether you are wondering how to authenticate against multiple STS.
Update: You can use VS to create a custom STS - not sure if HRD is out-the-box. What other authentication stores do you need to cater for? Why do you think you need a custom STS? You can use multiple instances of ADFS all federated against each other or federate ADFS with PingIdentity or OpenAM ... Have a look at IdentityServer. That's a custom STS which is a very good base to use.
Update 2: Yes - you are correct.
I am developing an ASP.NET Web application which should be accessible to the users who can access from both intranet and internet. Could you suggest the approach to implement this with ADFS 2.0.
The requirement is when users are logged in in the intranet the authentication to the app should be seamless without giving user id and password. Whereas for the same users if they are accessing out side intranet it should take email id and password as creditentials and authenticate.
You can put an ADFS proxy in front of ADFS for external users which by default uses Forms.
Internal users will get Windows Auth.
ADFS out-the-box only allows authentication with user name.
You would have to do some custom development - refer Adjusting the Home Realm Discovery page in ADFS to support Email Addresses.
We have an ASP.NET web application that we offer as a Service (it's hosted and it's accessible on the Web). We use Forms Authentication and our users have to enter a username/password to connect to our application. Some of our customers ask that we support single sign-on by authenticating users with their own Active Directory.
Our application has a different URL for each customer
www.ourapp.com/client1/
www.ourapp.com/client2/
www.ourapp.com/client3/
and each URL has its own web.config file (where asp.net settings can be specified and can vary for each customer).
What do I have to change in my ASP.NET application to support that?
What do I have to change on my Windows server configuration?
What will the customer have to do on his side to enable that?
Regards,
Check How To: Use Forms Authentication with Active Directory in ASP.NET 2.0 In short, you configure an ActiveDirectoryMembershipProvider to verify each username/password with the customer's AD. The customer must create an AD account for you that is allowed to perform the verification - which may be a problem with some customers. What's more, your code will handle the actual username/password used by users in their internal network, which can be an even bigger problem with customers.
A more secure solution is to use federation (using ADFS) or Claims Authentication using Windows Identity Foundation. In this case you "only" have to set trust relations between your domain and theirs.