-1

We have requirement of build .NET based plugin/component for enabling Authentication against multiple IDP providers like ADFS, Azure AD and Shibboleth based on DB configuration. i.e, depending on the configurable parameter the anonymous user will be authenticated against any one of the IDPs like ADFS, Azure AD or Shibboleth IDP.

Our application URL ("https://www.contoso.com/ProcessToken.aspx") will be registered as RP Identifier in all of the 3 providers.

We won't make any web.config changes for any of the providers.

At run time, User will access common page(Proesstoken.aspx) who needs to get redirected to the any of the Login page URLs at the provider (ADFS, Shibboleth, Azure) for Authentication based on User Organization. (For ex: User A to ADFS, User B to Shibboleth etc)

After Successful authentication at the IDPs the user needs to get redirected by the provider (ADFS/ Shibboleth/ Azure AD) to the RP Url registered.

In the redirected page (ProcessToken.aspx), we are planning to get the security token and decipher the claims required.

The main intention is to decouple authentication away from application logic and it should be extendable to other providers in future.

PS: Considered options like OWIN Authentication Middle Tier, .NET Component etc.

Need guidance on How and where to start.

Saravanan
  • 283
  • 2
  • 17

2 Answers2

0

You can configure ADFS to have Claims Provider Trust with the other IDP's Owin will acknowledge the authentication. The difficult part will be reading the attributes from the tokens. ADFS under the covers in conjunction with the Owin framework use ws-federation, I have not figured out how to read the SAML.

What gets confusing is that at one time the answer was WIF but now that 4.51 has been released, WIF was moved into Owin. The documentation for a multi-tenant application is sketchy at best.

user3263437
  • 1
0

Have a look at IdentityServer 3 which implements this multi-auth scenario or OWIN : ASP.NET MVC application with multiple authentication options.

The main point is that you use NuGet to download all the protocols you require and than use OWIN to pull them all in via app.use.

rbrayb
  • 46,440
  • 34
  • 114
  • 174