Ufdjrw

Does anyone have a working sample for Sustainsys Saml2 library for ASP.NET Core WebAPI only project (no Mvc) and what's more important without ASP Identity? The sample provided on github strongly relies on MVC and SignInManager which I do not need nor want to use.

I added Saml2 authentication and at first it worked fine with my IdP (I also checked the StubIdP provided by Sustainsys) for first few steps so:

• IdP metadata get properly loaded


• My API properly redirects to sign-in page


• Sign-in page redirects to /Saml2/Acs page, and I see in the logs that it parses the result successfully

However I don't know how to move forward from there and extract user login and additional claims (my IdP provided also an e-mail, and it is included in SAML response which I confirmed in the logs).

Following some samples found on the web and modyfing a little bit the MVC Sample from GitHub I did the following:

In Startup.cs:

...
.AddSaml2(Saml2Defaults.Scheme,
 options =>
 
 options.SPOptions.EntityId = new EntityId("...");
 options.SPOptions.ServiceCertificates.Add(...));
 options.SPOptions.Logger = new SerilogSaml2Adapter();
 options.SPOptions.ReturnUrl = new Uri(Culture.Invariant($"https://localhost:44364/Account/Callback?returnUrl=%2F"));

 var idp =
 new IdentityProvider(new EntityId("..."), options.SPOptions)
 
 LoadMetadata = true,
 AllowUnsolicitedAuthnResponse = true, // At first /Saml2/Acs page throwed an exception that response was unsolicited so I set it to true
 MetadataLocation = "...",
 SingleSignOnServiceUrl = new Uri("...") // I need to set it explicitly because my IdP returns different url in the metadata
 ;
 options.IdentityProviders.Add(idp);
 );

In AccountContoller.cs (I tried to follow a somewhat similar situation described at how to implement google login in .net core without an entityframework provider):

[Route("[controller]")]
[ApiController]
public class AccountController : ControllerBase
{
 private readonly ILog _log;

 public AccountController(ILog log)
 
 _log = log;
 

 [HttpGet("Login")]
 [AllowAnonymous]
 public IActionResult Login(string returnUrl)
 
 return new ChallengeResult(
 Saml2Defaults.Scheme,
 new AuthenticationProperties
 
 // It looks like this parameter is ignored, so I set ReturnUrl in Startup.cs
 RedirectUri = Url.Action(nameof(LoginCallback), new returnUrl )
 );
 

 [HttpGet("Callback")]
 [AllowAnonymous]
 public async Task<IActionResult> LoginCallback(string returnUrl)
 

 var authenticateResult = await HttpContext.AuthenticateAsync(Constants.Auth.Schema.External);

 _log.Information("Authenticate result: @authenticateResult", authenticateResult);

// I get false here and no information on claims etc.
 if (!authenticateResult.Succeeded)
 
 return Unauthorized();
 

// HttpContext.User does not contain any data either


// code below is not executed
 var claimsIdentity = new ClaimsIdentity(Constants.Auth.Schema.Application);
claimsIdentity.AddClaim(authenticateResult.Principal.FindFirst(ClaimTypes.NameIdentifier));

 _log.Information("Logged in user with following claims: @Claims", authenticateResult.Principal.Claims); 

 await HttpContext.SignInAsync(Constants.Auth.Schema.Application, new ClaimsPrincipal(claimsIdentity));

 return LocalRedirect(returnUrl);
 

TLDR: Configuration for SAML in my ASP.NET Core WebApi project looks fine, and I get success response with proper claims which I checked in the logs. I do not know how to extract this data (either return url is wrong or my callback method should work differently). Also, it is puzzling why successfuly redirect from SSO Sign-In page is treated as "unsolicited", maybe this is the problem?

Thanks for any assistance