Implement Office 365 styled Basic Authentication (Active Profile)

Question

I'm working on a SaaS application built around ASP.net MVC & WebAPI and want to make it easy for enterprises to use my service. Example would be Office 365 Basic Authentication (Active Profile) where the user enters his username/password on microsoft's site (or desktop app) and he is authenticated against his employer's Active Directory. My understanding so far is that I would need to create a RP-STS which will accept credentials and then forward those to AD FS Proxy running on the client company's AD server. Is this correct?

If yes, then how do I implement this? Setting up AD server adding a Relying Party and AD FS Proxy Role is easy, so that's really not an issue. I just need to figure out how to create/setup RP-STS service and any other steps involved in this process. There just isn't an example/tutorial of this in .net

Dan Ling · Accepted Answer · 2015-07-08T20:35:28.570

I believe this msdn blog post describes exactly what you're asking for. It has a complete walkthrough of the entire process, including creating an RP by creating a normal WCF service, and then use the provided utility to configure the service to trust your ADFS.

http://blogs.msdn.com/b/mcsuksoldev/archive/2011/08/17/federated-security-how-to-setup-and-call-a-wcf-service-secured-by-adfs-2-0.aspx

Edit:

This code, taken from the linked article (comments are mine), is a demonstration of active federation. The client application is manually retrieving a security token from the ADFS. Passive Federation would involve forwarding the user to a secure web page in which they could send their credentials directly to the ADFS. The major benefit of Passive Federation is that the end user's secret credentials are provided directly to the ADFS, and the RP's client side code never has access to it.

var requestTokenResponse = new RequestSecurityTokenResponse();

//The line below is the 'Active' federation
var token = Token.GetToken(@"mydomain\testuser", "p@ssw0rd", "http://services.testdomain.dev/wcfservice/Service.svc", out requestTokenResponse);

var wcfClient = new FederatedWCFClient<MyTestService.IService>(token, "WS2007FederationHttpBinding_IService");   // This must match the app.config
var client = wcfClient.Client as MyTestService.IService;
var result = client.GetData();
Console.WriteLine(result);
wcfClient.Close();

To further clarify, the link above IS using Active Federation. The code sample showing how to implement a method called "GetToken", which is used by the client application to retrieve a token on-demand, is an example of Active Federation. — Dan Ling, Jul 08 '15 at 20:27
You are correct this is an example of "Active Federation". However, the code sample is specific to authenticating against a WCF service which is secured by ADFS. I was looking for authenticating a user against an ADFS endpoint - to get the security token. Please see my answer for more info/sample code. — tunafish24, Jul 09 '15 at 03:16
The link I shared here also includes code samples for authenticating to the ADFS endpoint to retrieve the token. But, either way, you got your answer! — Dan Ling, Jul 09 '15 at 03:55

Fabio · Answer 2 · 2015-07-08T20:05:28.533

2

Take a look at these links:

https://github.com/OfficeDev/O365-WebApp-SingleTenant https://github.com/OfficeDev/O365-WebApp-MultiTenant

It shows how to make an application using the office 365 api to authenticate and authorize the users.

Be aware about Single Tenant and Mult Tentant application, and choose the right one.

It's really easy to do that, I've done it couple months ago.

edited Jul 08 '15 at 20:05

answered Jul 08 '15 at 18:08

Fabio

11,892
1
25
41

This looks like the traditional "Passive Federation", wherein the user is redirected to a logon page hosted by Identity Provider. – tunafish24 Jul 09 '15 at 03:03

score 0 · Answer 3 · answered Jul 09 '15 at 03:09

I found the answer on the blog: http://leandrob.com/2012/04/requesting-a-token-from-adfs-2-0-using-ws-trust-with-username-and-password/

What this code essentially does is that it directly authenticates with the tenant's ADFS endpoint and gets a token as well. That's what I was looking for.

var stsEndpoint = "https://[server]/adfs/services/trust/13/UsernameMixed";
var relayPartyUri = "https://localhost:8080/WebApp";

var factory = new WSTrustChannelFactory(
    new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
    new EndpointAddress(stsEndpoint));

factory.TrustVersion = TrustVersion.WSTrust13;

// Username and Password here...
factory.Credentials.UserName.UserName = user;
factory.Credentials.UserName.Password = password;

var rst = new RequestSecurityToken 
{
    RequestType = RequestTypes.Issue,
    AppliesTo = new EndpointAddress(relayPartyUri),
    KeyType = KeyTypes.Bearer,
};

var channel = factory.CreateChannel();

SecurityToken token = channel.Issue(rst);

Another good article on that blog is: http://leandrob.com/2012/02/request-a-token-from-adfs-using-ws-trust-from-ios-objective-c-iphone-ipad-android-java-node-js-or-any-platform-or-language/ - which covers other similar scenarios.

Implement Office 365 styled Basic Authentication (Active Profile)

3 Answers3