How should I implement SAMLP 2.0 in an ASP.NET MVC 4 service provider?

Question

I'm developing an MVC 4 web application in C# and want to handle login using an existing SAML 2.0 identity provider. I am using HTTP POST binding with SimpleSAMLphp.

It seems like, in .NET 4.5, I should be using Windows Identity Foundation. First, I tried to install the Identity and Access Tool. (I am using Visual Studio 2013, which is supposed to have this tool integrated, but VS2013's version doesn't support "re-entrancy", meaning I can't use it to add WIF support to my existing application.)

After pointing the Identity and Access Tool to my identity provider's metadata, I get this error message:

Apparently, this is the error message that indicates that SAMLP 2.0 is not supported by WIF. This seems to be distinct from SAML 2.0 tokens, which are supported (at least, this outdated documentation indicates that there was a Microsoft.IdentityModel.Tokens.Saml2 namespace).

I then discovered the WIF Extension for SAML 2.0. However, this was released in May 2011 and doesn't seem to have been touched since then. Nonetheless, I downloaded the extension and attempted to build the SamlConfigTool included in the ZIP file. The tool is a console application which informs me that:

This tool will prompt for information needed to create a metadata file that describes your relying party. It will prompt for the addresses of partner metadata files to be downloaded. Finally, it will output a file called Changes_To_Web_Config.xml that has the changes that should be made to your web site's web.config file to enable SAML protection.

After entering my entity ID and SAML endpoint, the SamlConfigTool promptly crashed. Okay, maybe I don't need to use the configuration tool and I can just copy what's done in the sample ServiceProvider VS project. After migration, I'm able to open the project in VS2012, but it's not clear to me exactly how it works — it doesn't seem to contain any C# code, just new entries in Web.config. It's not clear to me how I should adapt this configuration to replace the custom login code in my MVC 4 app, and in any case relying on a dead library from 3 years ago doesn't seem like a great idea.

So, what is the best way to implement SAML 2.0 in ASP.NET MVC 4? I'm currently decoding, encoding, parsing and compressing XML by hand and it feels like there should be an easier way.

Solution 1

You're right in that WIF (now moved into core .NET under System.IdentityModel) only supports the SAML2 tokens and not the SAML2 protocols required to implement a service provider.

Kentor.AuthServices is an open source SP implementation for ASP.NET MVC built on top of .NET 4.5. Install the package and add some settings in web.config - no coding required.

Disclaimer: I'm the author of Kentor.AuthServices

Solution 2

As far as I know there is no support for SAML2P in WIF yet. I would suggest you implement it yourself.

You could use a library that implements SAML2P and use it in your MVC project. Some of the libraries you could use are OIOSAML.NET or commercial ComponentPro SAML.

Or there is an option to set an intermediate IAM. From MVC you set ideneity provider as this intermediate IAM using ws-* protocol (standard way implemented in visual studio). This IAM should be configured to relay your authentication messages to the IDP you want to use with SAML2P. After authenticating the user the IAM would only transform the claims and issue a new token that you MVC application trusts. Try to look at Shibboleth or ThinkTecture IdentityServer v2 (but the second does not implement SAML2P so you would have to add the support yourself). Or you could use ADFS2.

Solution 3

How about http://www.nuget.org/packages/SAML2/ ? It says it's a fork from OIOSAML.NET.

Solution 4

You need a library, unless you want to write it yourself. I've been working with https://www.nuget.org/packages/ITfoxtec.Saml2.Mvc.

View more solutions

Comments

[woloski]

As far as third party services, there is also Auth0 that supports samlp.

[sjy]

I've installed AuthServices and added the [appropriate sections][1] to my Web.config, and my project still builds, but I'm having trouble getting AuthServices to do anything. Adding the [Authorize] attribute to my ActionResult doesn't seem to do anything.

[Anders Abel]

Try yoursite/AuthService/SignIn. It should start the login (I obviously need to update the docs with the MVC stuff). To get automatic redirection, set auth mode to forms and loginUrl to ~/SignIn: msdn.microsoft.com/en-us/library/…

[surfmuggle]

As far as i have heard .Net 4.5 does support samlp: connect.microsoft.com/VisualStudio/feedback/details/781848/…

[pepo]

One of these 39 ups in the survey is mine :) I would also like if it would be supported but to this day I have found no official reference to it in .NET framework. However Azure and ADFS supports it.

[rbrayb]

To flesh out @woloski's comment, wrote this up: nzpcmad.blogspot.co.nz/2015/04/…

[JDPeckham]

you mean AuthServices/SignIn with an "S"

[Denis Wang]

how do you like it? we are evaluating different packages and ITfoxtec is on top of the short list

[edson-]

We have it in production now. Note that ITFoxtec has gone through a rewrite since, and we are still using the older version. Due to the specifics of our particular IdP implementation, we had to make a minor modification, so it was good to have the source code available.

[Denis Wang]

thanks. good to know that. i like it for its license type and the open source code. may evaluate its quality soon :)

[iokevins]

@pepo FWIW, please see cheated.by.safabyte.net which shows Component Pro likely represents the latest incarnation of stolen SAML software. TY