How to configure .NET 8 AspNetCore Identity with Active Directory Federation Services (ADFS) as external provider using OpenIdConnect

[mihaimyh]

Hello,

I am having hard time trying to configure the new .NET8 Identity with an on-premise ADFS as external provider for Identity using OpenIdConnect in a Blazor application.
Up until now, I have added the following:

services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = IdentityConstants.ApplicationScheme;
        options.DefaultAuthenticateScheme = IdentityConstants.ApplicationScheme;
        options.DefaultChallengeScheme = IdentityConstants.ApplicationScheme;
        //options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
        options.DefaultSignInScheme = IdentityConstants.ApplicationScheme;
        options.DefaultSignOutScheme = IdentityConstants.ApplicationScheme;
    })
    .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, "ADFS", options =>
    {
        //IdentityModelEventSource.ShowPII = true;
        options.Authority = oidcOptions.Authority;
        options.CallbackPath = oidcOptions.CallbackPath;
        options.ClientId = oidcOptions.ClientId;
        options.ClientSecret = oidcOptions.ClientSecret;
        options.ResponseType = oidcOptions.ResponseType;
        options.SaveTokens = oidcOptions.SaveTokens;
        options.Resource = oidcOptions.Resource;
        options.UseTokenLifetime = oidcOptions.UseTokenLifetime;
        options.UsePkce = oidcOptions.UsePkce;
        options.RequireHttpsMetadata = oidcOptions.RequireHttpsMetadata;
        if (oidcOptions.Scopes is { Count: > 0 })
        {
            options.Scope.Clear();
            foreach (var scope in oidcOptions.Scopes)
            {
                if (!options.Scope.Contains(scope))
                {
                    options.Scope.Add(scope);
                }
            }
        }
        options.TokenValidationParameters = new TokenValidationParameters
        {
            RequireSignedTokens = true,
            RequireAudience = true,
            RequireExpirationTime = true,
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            NameClaimType = ClaimTypes.NameIdentifier,
            ValidIssuers = oidcOptions.ValidIssuers,
            ValidAudience = oidcOptions.Resource,
            ValidAudiences = oidcOptions.ValidAudiences,
            ClockSkew = TimeSpan.FromSeconds(30)
        };
        options.Events = new OpenIdConnectEvents
        {
            OnAccessDenied = context =>
            {
                context.HandleResponse();
                context.Response.Redirect("/");
                return Task.CompletedTask;
            },
            OnAuthorizationCodeReceived = async context =>
            {
                var configuration = await options.ConfigurationManager.GetConfigurationAsync(context.HttpContext.RequestAborted);
                var request = new HttpRequestMessage(HttpMethod.Post, configuration.TokenEndpoint);
                request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                var redirectUri = new Uri(context.Request.GetEncodedUrl()).GetLeftPart(UriPartial.Authority) + oidcOptions.CallbackPath;
                var requestBody = new Dictionary<string, string>
                {
                { "client_id", options.ClientId },
                { "client_secret", options.ClientSecret },
                { "code", context.ProtocolMessage.Code },
                { "grant_type", "authorization_code" },
                { "redirect_uri", redirectUri },
                { "resource", oidcOptions.Resource } // Include the resource parameter
                };

                request.Content = new FormUrlEncodedContent(requestBody);
                var response = await options.Backchannel.SendAsync(request, context.HttpContext.RequestAborted);
                if (!response.IsSuccessStatusCode)
                {
                    var errorContent = await response.Content.ReadAsStringAsync();
                    Console.WriteLine($"Token request error: {response.StatusCode}, {errorContent}");
                    throw new HttpRequestException($"Token request failed: {response.StatusCode}");
                }

                var payload = JObject.Parse(await response.Content.ReadAsStringAsync());
                var accessToken = payload.Value<string>("access_token");
                var idToken = payload.Value<string>("id_token");
                context.HandleCodeRedemption(idToken, accessToken);
            }
        };
    })
    .AddIdentityCookies(options =>
    {
        options.ApplicationCookie?.Configure(cfg =>
        {
            //cfg.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
            //cfg.Cookie.SameSite = SameSiteMode.Strict;
            cfg.Cookie.HttpOnly = true;
            cfg.Cookie.Name = "DLM";
            cfg.ExpireTimeSpan = TimeSpan.FromHours(12);
            //cfg.Cookie.MaxAge = options.ExpireTimeSpan;
            cfg.SlidingExpiration = true;
            //cfg.EventsType = typeof(CustomCookieAuthenticationEvents);
            cfg.LoginPath = "/login";
            cfg.LogoutPath = "/account/logout";
            cfg.AccessDeniedPath = "/";
        });
    });

Are there any guidance of doing this properly? I only saw docs regarding WS-Federation.

[Tratcher]

What errors do you get?

Why not use WsFed?

Why are you doing OnAuthorizationCodeReceived manually? That looks similar to the built in logic.

[mihaimyh]

To include this "resource" property that ADFS is needing.

[MackinnonBuck]

This seems like a question about how to use the product rather than a report for a product issue, so I'm going to convert this into a discussion. Please also see https://learn.microsoft.com/aspnet/core/security/authentication/ws-federation?view=aspnetcore-8.0 in case it helps in your case.

[halter73]

https://medium.com/the-new-control-plane/authenticating-to-active-directory-federation-services-adfs-2019-with-net-core-3-1-b0bf012fc183 might also be helpful.