0

I'm working on a wsFederation POC for my company. The solution should work with MVC apps and webapi services as well. I figured out how to have it working on MVC apps, using the new OWIN authentication middleware. At that point I'm getting SAML2 tokens.

I now would like to make ajax calls to call a method from a webapi controller, passing the SAML token in the authorization header like this in javascript :

var token = '@ViewBag.Token';

        var request = {
            url: 'https://localhost:44305/api/test/GetStrings',
            cache: false,
            beforeSend: function (xhr) {
                xhr.setRequestHeader('Authorization', 'bearer ' + token);
            },
            type: 'GET',
            crossDomain: true,
            success: function () {
                alert('ok');
            },
            error: function () {
                alert('ko');
            }
        };

        $.ajax(request);

In Firebug (or equivalent), I can see that header is well populated wih the token.

On the server side, I'm trying to use a Thinktecture' Owin extension method to retrieve and check the token :

 app.UseSaml2BearerAuthentication(
            new Uri("urn:relyingparty2"),
            "3AA702552....643E27150591A9",
            "http://localSTS")
            ;

as i've read it here : http://leastprivilege.com/2013/10/31/adding-saml11-and-saml2-support-to-katanaowin/

But it seems that nothing happens.

I would like to avoid adding a message handler, as this method looks like it should do what I'm looking for ...

Any idea ?

PAP
  • 167
  • 8
  • How are you generating the token on the server? The Thinktecture stuff is a bridge between WIF and Owin handlers so you would need all the WIF stuff setup in your webconfig and your cert properly installed and referenced in the configs. – William May 20 '14 at 17:01
  • Ok; so maybe I misunderstood that Thinktecture thing. I was assuming that it would make the configuration unnecessary. The token is generated by Identity server (v2), for the moment... So What would be the best pattern for what i'm trying to achieve ? – PAP May 20 '14 at 19:04

0 Answers0