CODEWITHSUNDEEP
c#asp.netoauth-2.0adfs
Coyttl
Coyttl

Reputation: 534

ADFS v4.0 and /userinfo endpoint giving 405

Integrating older ASP.NET server-side application into ADFS for authentication, which means I pretty much had to write everything from scratch. have everything working (/authorize, /token) up until the /userinfo call.

My code, in a nutshell -

HttpClient client = new HttpClient();

var req = new HttpRequestMessage {
    RequestUri = new Url("https://<server_ip>/adfs/oauth2/userinfo"),
    Method = HttpMethod.Get,
};
req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);
req.Headers.UserAgent.Clear();
req.Headers.UserAgent.Add(new ProductInfoHeaderValue("OldApp", "11.3.0"));
var result = await client.SendAsync(req);

The result is a HTTP error 405 - Method Not Allowed. Doing searches online, I see this as a common issue when the trailing "/" is left off the url, but I get the same result with a trailing slash.

After poking around, there are a lot of examples that use newer libraries and such that I can't use, sadly. None mention usage of the /userinfo, and I'm thinking that the issue isn't necessarily in how I'm calling the URL, but configuration of the 'Application Group' in ADFS.

Upvotes: 1

Views: 1361

Answers (2)

Coyttl
Coyttl

Reputation: 534

Okay - I found the issue, and will document it here in case others come across the same thing..

While I am not sure why /userinfo is giving a 405 - the URL I was using is wrong, despite it being listed in the Endpoints folder. There shouldn't be any "oauth2" in the URL. The correct code (and URL) is:

var req = new HttpRequestMessage {
    RequestUri = new Url("https://<server_ip>/adfs/userinfo"),
    Method = HttpMethod.Get,
};
req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token.AccessToken);
req.Headers.UserAgent.Clear();
req.Headers.UserAgent.Add(new ProductInfoHeaderValue("OldApp", "11.3.0"));
var result = await client.SendAsync(req);

Also something to keep in mind - this has been stated elsewhere, but not as clearly as here, I hope: The /userinfo will ONLY give you the NameIdentifier ("sub") claim. (As far as I can see.) No matter what scope you pass it. You will get all your information (that should normally be in the /userinfo call) in the "id_token" parameter from you /token call, encoded as JWT.

Upvotes: 3

sayah imad
sayah imad

Reputation: 1553

Personally I was led to do the same thing as you, the only solution was to download the ADAL library (You will find the link below) and debug the code in order to re-produce the same HTTP stream from ADAL.

You can create a new project so that you can integrate ADAL, for debugging or else intercepting the HTTP stream

Link ADAL

Upvotes: 1

Related Questions