CODEWITHSUNDEEP
wpfpowershellauthenticationoauthadfs
Christian Loth
Christian Loth

Reputation: 31

ADFS vNext Client Authentication (WPF) (Windows Server 2016 Preview 3)

I have a Windows Server 2016 TechnicalPreview 3 with a configured ADFS vNext, as first client I have created an MVC Application as a ReplingPartyTrust. The authentication with the ADFS work really well with the MVC Application. Now to the problem: I have written a Native Application (WPF) which i want to authenticate against the ADFS. The Steps i did are:

  1. To inform the ADFS of my new WPF Client i ran the the following PowerShell Script:

    Add-ADFSClient -ClientType Public -Name “MyClient” -ClientId “E1CF1107-FF90-4228-93BF-26052DD2C714” -RedirectUri “https://E1CF1107-FF90-4228-93BF-26052DD2C714/redir´”

  2. To authenticate the client (Code-Wise) i used the following NuGet-Package: Microsoft.IdentityModel.Clients.ActiveDirectory (3.5 (Alpha)) Then I wrote the following code:

string authority = "https://win2016preview.server.local/adfs/ls";
string resourceURI = "https://adfs.server.local/MyMVCApp";
string clientReturnURI = "https://e1cf1107-ff90-4228-93bf-26052dd2c714/redir";
string clientID = "E1CF1107-FF90-4228-93BF-26052DD2C714";
var ac = new AuthenticationContext(authority, false);
var ar = await ac.AcquireTokenAsync(resourceURI, clientID, new 
Uri(clientReturnURI), 
new PlatformParameters(PromptBehavior.Auto, new  
WindowInteropHelper(this).Handle));

With this code, the client should authenticate at the ADFS (over OAuth i think) and prompt the user to enter his organisation credentials. If i run the application this window appears:

I choose Yes (Ja) and the credential prompt opens. In the same time the following exception occures

In the event log if the server ADFS the following error message appears:

Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthAuthorizationUnauthorizedClientException: MSIS9321: Received invalid OAuth request. The client 'E1CF1107-FF90-4228-93BF-26052DD2C714' is forbidden to access the resource 'https://adfs.server.local/MyMVCApp. at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthAuthorization.OAuthAuthorizationRequestContext.ValidateCore() at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate() at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthAuthorization.OAuthAuthorizationProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext) at Microsoft.IdentityServer.Web.PassiveProtocolListener.GatherDeviceSecurityToken(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler) at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

As far as i can tell, the ADFS recognizes the Client Id and tries to authenticate it. But the ADFS rejects the Client. Did i forget to configure something? The client should just prompt the user, which authenticates against the ADFS, so the client can habe the AuthenticationToken.

I hope you can follow me. Thank you in advance!

Upvotes: 2

Views: 1131

Answers (1)

Christian Loth
Christian Loth

Reputation: 31

The solution is very simple :)

Add the property IssuanceAuthorizationRules (Add-ADFSRelyingPartyTrust )

-IssuanceAuthorizationRules '=> issue (Type = "http://schemas.microsoft.com/authorization/claims/permit" value = "true");'

Upvotes: 0

Related Questions