I am migrating an ASP.NET application to be on ASP.NET Core, but have met a problem of Ws-Federation authentication: there is no [Ws-Federation] (https://www.nuget.org/packages?q=Microsoft.Owin.Security.WsFederation) OWIN middleware available in ASP.NET Core platform.
But I noticed all authentication middleware for ASP.NET Core are now under Microsoft.AspNetCore.Authentication namespace, so I searched all packages from nuget.org and found most of the authentication packages are there, but unfortunately only the Microsoft.AspNetCore.Authentication.WsFederation is missing.
So, I would like to know, if the package is missing because it is not implemented yet or any other reason? Alternatively, is there existing ASP.NET Core based authentication middleware for Ws-Federation?
It's not implemented yet, mainly because .NET Core doesn't have the encrypted XML and XML dsig classes needed.
See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/500
I've ported the Katana middleware over to ASP.NET Core. It has a hard dependency on the full .NET Framework since that is the only place the required libraries exist right now.
https://github.com/chrisdrobison/aspnetcore-wsfed
It appears .NET Core 2.1 WS Federation package is now available. Microsoft.AspNetCore.Authentication.WsFederation.
More information found at the following link:
https://learn.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation?view=aspnetcore-2.1
Related
I'm beginning the R&D (and scoping requirements) to implement an OAUTH2 Authorization Server, and our existing framework is ASP.NET (version 4.6.1 +). Is there an existing well-exercised SDK for this? I see that the oauth.net folks are still pointing .NET developers to the NuGet package(s) DotNetOpenAuth, but it looks like the relevant packages there have not been touched since 2013. Is that just because they are really stable and hence really solid? Or has the world moved on and I should be looking elsewhere for building blocks for an OAUTH2 server implementation?
Advice very welcome!
As mention below statement from Article link how we can implement in MVC?
Katana allows you to build web based applications, such as MVC or Web API (2) where you can decide which web features to include in the project.
Article link
Katana is no longer being developed. According to their roadmap,
The next major version of Katana is part of the ASP.NET vNext project on GitHub
"ASP.NET vNext" is the early name for what is now ASP.NET Core. The architecture of ASP.NET Core continues (and improves on) the modular architecture that Katana used. You can build an ASP.NET Core MVC project using only the packages you need.
For further reading, check out my answers to Is Owin/Katana supposed to replace Web API? and Does ASP.NET Core still use OWIN?
I had a ServiceAccount hookup in my .NET Core RC1 app that worked fine. However now, "ServiceAccountCredential" doesn't exist in "Google.APIs.Auth.OAuth2" anymore. The whole library seems to be missing a ton of classes in the RTM version of Core.
Here are the related packages in my project.json
"Google.Apis.Core": "1.14.0",
"Google.Apis.Auth": "1.14.0",
"Google.Apis.Oauth2.v2": "1.14.0.540"
I even tried using the RC1 packages, but I keep getting the same thing. Is it simply because Google Auth isn't fully supported in Core yet?
The Google API's indeed do not fully support .NET Core yet: https://github.com/google/google-api-dotnet-client/issues/695.
In fact the ServiceAccountCredential is problematic (as I mentioned here) since it calls Windows-specific API's to parse the certificate. It has to be implemented cross-platform first to fully support .NET Core (.NET Standard actually).
I am currently checking out asp.net vnext MVC6 in Visual Studio 2015 Preview. I'm pretty new to asp.net in general, but within my company we are going to move towards creating a web api using asp.net for accessing data on our server (currently we only support wcf communication with our own silverlight application). This is the reason I am checking out the new functionalities of MVC 6 to judge whether we should wait before starting our development and use MVC 6 when it is finally released or start development now and create a Web API 2 project.
Anyway, I am looking into auto documenting the web api, which is already integrated into the Visual Studio template for a WebApi 2 project by use of Microsoft.AspNet.WebApi.HelpPage.
Now for my question, is something like this available for MVC 6 aswell? I can import the same package in my project.json in my ASP.NET vNext / MVC6 (whatever you want to call it) project but i can't do app.UseHelpPage(); in my Startup.cs file.
I suspect this is not (yet) integrated in the current release yet. If not, is there anything known about integration of this feature once ASP.NET vNext eventually hits the shelves?
Probably this feature is not available in MVC 6 yet, but you could try Swagger.
Swagger basically is a framework for describing, consuming, and visualizing RESTful APIs.
The nice thing about Swashbuckle that it has no dependency on ASP.NET MVC, so there is no need to include any MVC Nuget packages in order to enable API documentation, as well Swashbuckle contains an embedded version of swagger-ui which will automatically serve up once Swashbuckle is installed.
Source: http://bitoftech.net/2014/08/25/asp-net-web-api-documentation-using-swagger/
This is a second attempt with better wording of the problem I'm facing.
I have a simple requirement to implement an application that will allow web applications and standalone services that will be claims-aware (using ADFS). Note that I am talking about windows services in addition to web applications.
Which enabling interoperable technologies should a developer pick?
For the life of me, I can't find a resource that says: to build a claims-aware application using the latest upcoming frameworks, install these packages.
From a framework point of view, I am talking about the following:
Microsoft.IdentityModel
Microsoft.Owin
System.IdentityModel
Microsoft.Asp.Net.Identity
Which should I be using? Alpha / Beta packages are fine.
Thank you,
Richard
in .net 4.5 IdentityModel is now part of the core libraries (so it no longer called Microsoft.IdentityModel).
So for your system you would need the following:
System.IdentityModel for the FederationAuthenticationModule (which intercepts and verifies your SAML token submission) and for the SessionAuthenticationModule (which serializes/deserializes your claims.)
To create the claims that you will send between your applciations you would use:
System.Security.Claims
as I mentioned these are both in .net 4.5.
Microsoft.IdentityModel is the one you are looking for.
Microsoft.IdentityModel.Claims for IClaimsIdentity interface.
Microsoft.IdentityModel.Web for WSFederationAuthenticationModule.
Yup - System.IdentityModel is the way to go.
Refer: What's New in Windows Identity Foundation 4.5.
If you are wondering what the difference between WIF 3.5 and 4.5 is, refer:
Guidelines for Migrating an Application Built Using WIF 3.5 to WIF 4.5