CODEWITHSUNDEEP
asp.net-coresaml-2.0
Tedd Hansen
Tedd Hansen

Reputation: 12362

ASP.Net Core SAML authentication

I am trying to add SAML 2.0 authentication to an ASP.Net Core solution. I can't find any documentation on the subject, so I am unsure where to start. There is probably documentation out there, but I don't want to spend 3 days becoming an expert on this.

From what I can see ASP.Net Core has changed something from the old OWIN assemblies/namespaces. There are third party libraries to simplify SAML 2.0 implementation such as Kentor.AuthServices.

I am unsure how to combine this with ASP.Net 5 RC 1 / ASP.Net Core. For example making use of the AspNet* tables in SQL.

ASP.Net 5 RC 1 comes with several libraries to implement authentication (client).

For example:

Implementing these is a matter of calling a simple extension method in Startup.cs:

app.UseIdentity()
.UseFacebookAuthentication(new FacebookOptions
{
    AppId = "ID",
    AppSecret = "KEY"
})
.UseGoogleAuthentication(new GoogleOptions
{
    ClientId = "ID",
    ClientSecret = "SECRET"
})
.UseTwitterAuthentication(new TwitterOptions
{
    ConsumerKey = "KEY",
    ConsumerSecret = "SECRET"
});

Once that is done the ASP.Net sample project automatically shows social buttons for login/manage account:

Social buttons

In the backend code the authentication providers are retrieved using var otherLogins = _signInManager.GetExternalAuthenticationSchemes().Where(auth => userLogins.All(ul => auth.AuthenticationScheme != ul.LoginProvider)).ToList();. This means the authentication providers are registered somewhere that makes them available by calling _signInManager.GetExternalAuthenticationSchemes().

How can I implement SAML 2.0 authentication in ASP.Net 5 RC1 / ASP.Net Core?

Upvotes: 40

Views: 55458

Answers (5)

Alex from Jitbit
Alex from Jitbit

Reputation: 60536

[Disclaimer: I'm a contributor of the OSS project mentioned below]

The free AspNetSaml library has been around since 2016 and works perfectly with ASP.NET Core, available as a NET Standard 2.0 nuget package (270K downloads at nuget).

Redirecting a user to an IdP provider is as simple as:

var request = new AuthRequest(
    "http://myapp.com", //your app's "entity ID" here
    "http://myapp.com/SamlConsume" //URL to send users back to
);

//MVC redirect
return Redirect(request.GetRedirectUrl("http://saml-provider.com/login/"));

Upvotes: 5

Pratik
Pratik

Reputation: 11

For the ASP.NET core sites you can give a try for this SSO connector solution. I installed this connector as a separate .NET application (a proxy app) which was handling the SSO requests for my ASP.NET core application and then I integrated this connector with my app using some code. All required integration code was already there in the connector itself, which I just copy and pasted in my application. It was quite a simple setup for adding the SSO. I think this connector can be very useful for adding the SSO in ASP.NET core apps.

Upvotes: 0

JohnnyFun
JohnnyFun

Reputation: 4293

This is probably basically an updated version of Anders Abel's answer, but:

I used https://github.com/Sustainsys/Saml2. They have a nuget package with 36k downloads called "Sustainsys.Saml2.AspNetCore2".

They have a helpful example .net core app using it that also uses .net core identity here: https://github.com/Sustainsys/Saml2/tree/master/Samples/SampleAspNetCore2ApplicationNETFramework (take a look at their startup.cs and also their external login razor pages for implementation details).

They also host a nice test IdP here: https://stubidp.sustainsys.com. That way, you can confirm your app's ACS (Assertion Consumer Service) endpoint works along with your login page and whatnot.

They mention on their github: "The library was previously named Kentor.AuthServices."

Upvotes: 16

Anders Revsgaard
Anders Revsgaard

Reputation: 4334

ITfoxtec Identity Saml2 now support .NET Core 2.1.

Project: https://itfoxtec.com/IdentitySaml2 and code samples: https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test

To implement SAML 2.0 in a ASP.NET MVC Core 2.1 project you need the following NuGet package: https://www.nuget.org/packages/ITfoxtec.Identity.Saml2.MvcCore/

Upvotes: 3

Anders Abel
Anders Abel

Reputation: 69250

As far as I know, there is no SAML2 implementation for ASP.NET Core. I'm planning to make an ASP.NET Core Middleware for Kentor.AuthServices (I'm the maintainer), but it's just plans yet.

There is now a working prototype of a ASP.NET Core middleware at https://github.com/KentorIT/authservices/pull/489. It will be included in the official release when tests have been added.

It's also important to know that while such a middleware would be compatible with the ASP.NET Core security model, it would only run on the full .NET Framework and not on .NET Core. The reason is that SignedXml and the SAML2 support in System.IdentityModel is not yet available in .NET Core.

Upvotes: 14

Related Questions