How to secure Static Content under ASP.NET MVC and OWIN

Armin Kalajdzija — Mon, 10 Oct 2016 10:38:33 GMT

As you can see in my previous post, I am currently working on securing an ASP.NET MVC Web Application based on OWIN. Because of that is this post some sort of continuation of my previous one.

So, my Web Application in pure Single Page Application that works on AngularJS and is being generated by a Gulp Task Runner as a static content. Because we also have some REST Web API Methods in our Application that are used by Single Page Application, it was not possible to implement the Security of our Web Application completely on Client via ADAL or any other Javascript Library so we used (in our case Active Directory Federation Services) Owin Security Provider and added it to our ASP.NET MVC Web Application. Now we can easily use [Authorize] Tags on our Web API Methods.

But now we had a Problem of securing our Single Page Application that is actually a static content in our ASP.NET MVC Web Application. For that I injected this simple Code Snippet that will be called upon every Request:

app.Use((context, cont) =>

{

if ((context.Authentication.User != null) &&

(context.Authentication.User.Identity != null) &&

(context.Authentication.User.Identity.IsAuthenticated))

{

return cont();

}

else

{

context.Authentication.Challenge(WsFederationAuthenticationDefaults.AuthenticationType);
return Task.Delay(0);

}

});

It simply checks if the user is authenticated, and if not, it Challenges our OWIN Authentication Provider to authenticate the user (in our case ADFS). Now we don't even have to use our [Authorize] Tags because all Request will need to be authenticated, what can make some problems in certain cases if you have some Web API Methods that needs to be publicly exposed.

How to implement Web Sign On with ADFS in ASP.NET MVC using OWIN

Armin Kalajdzija — Thu, 06 Oct 2016 14:08:39 GMT

In this Post I will (try to) shortly explain how to Implement Web Sign on with Active Directory Federation Services under ASP.NET MVC and OWIN/Katana as Middleware.

There is plenty of Resources (read Code Snippets) on the Net about this subject, but what I actually found as important as the Code Snippets is actual Configuration of AD FS Server. The Configuration of ADFS is highly sensitive on every identifier, endpoint definition and even on every character like underscores, slashes, and of course prefixes like http/https are all exactly to be defined and used in your Web App!

ADFS Server Configuration

That is why I will first show some screenshots and Configuration of my ADFS Server running on Azure VM Development Environment:

Under Authentication Policies, you should enable Forms Authentication for Extranet users. That way it will be possible for users outside your Domain or on a Public Computer to get a nice Forms Authentication provided by ADFS and still get authenticated.

You should create new Relying Party Trust with following Configuration: Display Name you can write whatever you want of course. Under Relaying party identifiers, you should add exactly your Web Application URL (Including correct prefix and slash at the end. If you have more Bindings on you Web Application, define all of them.
NOTE: Some users had problems if their Web Application URLs contains underscores, so if you can, try to avoid them.

Under Endpoint Tab, add a WS-Federation Passive Endpoint with the same URL of your Web Application as in Relying party identifiers.
Note: You can also define multiple if you have more the one Binding, but only one can be Default.

Now knowing your exact ADFS Configuration, you will definitely save time and avoid configuration conditioned Problems so we can continue and finally write some Code.

ASP.NET Web Application with OWIN Middleware

First we will start off with OWIN Startup.cs Class. We have the Authentication Configuration Method outsourced into separate Class called Startup.Auth.cs, like the Default ASP.NET MVC Web Application Template do it, but many of you have it all directly under Startup.cs.

Startup.cs

using System.Threading.Tasks;

using Microsoft.Owin;

using Microsoft.Owin.Security.WsFederation;

using Owin;

[assembly: OwinStartupAttribute(typeof(adfs.demo.Startup))]

namespace adfs.demo

{

public partial class Startup

{

public void Configuration(IAppBuilder app)

{

ConfigureAuth(app);

}

Startup.Auth.cs

using System.Configuration;

using Microsoft.Owin.Security.Cookies;

using Owin;

using Microsoft.Owin.Security;

using Microsoft.Owin.Security.WsFederation;

namespace adfs.demo

{

public partial class Startup

{

public void ConfigureAuth(IAppBuilder app)

{

app.UseCookieAuthentication(

new CookieAuthenticationOptions

{

AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType

});

app.UseWsFederationAuthentication(

new WsFederationAuthenticationOptions

{

MetadataAddress = ConfigurationManager.AppSettings["ida:ADFSMetadata"],

Wtrealm = ConfigurationManager.AppSettings["ida:Wtrealm"]

});

app.SetDefaultSignInAsAuthenticationType(WsFederationAuthenticationDefaults.AuthenticationType);

}

Here is important that you extract your ADFS Metadata Address correctly from your Server which is by Default http://youradfsserver.address.com/FederationMetadata/2007-06/FederationMetadata.xml.
In Wtrealm out your Relying Party Identifier from ADFS Server from first part of the Post.

Both of this entries I have placed in Web.Config and it looks like this:

</appSettings>

Now that should be enough to have OWIN Security running with our ADFS Server. All you have to do now is to add the [Authorize] Tags on needed Controllers or [AllowAnonymous] on single Actions that needs to be accessed anonymously.

Here is one very simple way of using a Templated AccountController.cs with our ADFS Implementation:

using System.Web;

using System.Web.Mvc;

using Microsoft.Owin.Security;

using Microsoft.Owin.Security.Cookies;

using Microsoft.Owin.Security.WsFederation;

namespace adfs.demo.Controllers

{

[Authorize]

public class AccountController : Controller

{

[AllowAnonymous]

public void Login(string returnUrl)

{

if (!Request.IsAuthenticated)

{

HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/adfs.demo" },

WsFederationAuthenticationDefaults.AuthenticationType);

}

public void LogOff()

{

string callbackUrl = Url.Action("Index", "Home", routeValues: null, protocol: Request.Url.Scheme);

HttpContext.GetOwinContext().Authentication.SignOut(

new AuthenticationProperties { RedirectUri = callbackUrl },

WsFederationAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType);

}

Conclusion

It was actually pretty easy to implement the ADFS Authentication Provider in OWIN once you understand and have access the whole configuration of ADFS Server. So far it looks really fast and stable, beside few problems I had with Chrome and Firefox Browser that I will explain below. So as I promised, this was actually short post and I hope you will get your ADFS running smoothly just as I did.

Chrome / Firefox Redirection Loop Problem
After my first Implementation of ADFS under OWIN, it looked like everything is working well. As soon as I tested it on Chrome and Firefox, I figured out that after Login, I am being redirected to ADFS Forms Authentication Web Page and back to my Default Return URL few times before getting Error Message (that was not telling me much about Error) on my ADFS Forms Authentication Web Page.

In ADFS Event Log, there was this Error event:
Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '1' seconds. Contact your administrator for details.

There are many explanations and workarounds for the Redirection Loop Problem under OWIN Security, most of them have something to do with CookieManager under OWIN but none of them has solved my problem.

My Solution:
As soon as I have defined "fresh" new Relying Party Trust (see first part of the Post) with exactly the same Relying Party Identifier as an WS-Federation Passive Endpoint URL (and I really mean exactly the same, same prefix, same URL and / at the end of URL, also see first part of the post) and then updated my Web.Config with the exact Values, it all started working as a Charm.

Armin Kalajdzija Posts : OWIN

How to secure Static Content under ASP.NET MVC and OWIN

How to implement Web Sign On with ADFS in ASP.NET MVC using OWIN