Duende SAML 8.0.x returning null from GetAuthorizationContextAsync

[secart]

After migrating to Duende SAML from Rsk.Saml the authorization context returns null from the method below:

var context = await _interaction.GetAuthorizationContextAsync(Input.ReturnUrl, HttpContext.RequestAborted);

This is due to the type casting of the result to an AuthorizationRequest highlighted below.

public async Task<AuthorizationRequest?> GetAuthorizationContextAsync(string? returnUrl, Ct ct)
{
    using var activity = Tracing.ServiceActivitySource.StartActivity("DefaultIdentityServerInteractionService.GetAuthorizationContext");

    if (string.IsNullOrEmpty(returnUrl))
    {
        _logger.LogTrace("No AuthorizationRequest being returned");
        return null;
    }

+    var result = await _returnUrlParser.ParseAsync(returnUrl, ct) as AuthorizationRequest;

    if (result != null)
    {
        _logger.LogTrace("AuthorizationRequest being returned");
    }
    else
    {
        _logger.LogTrace("No AuthorizationRequest being returned");
    }

    return result;
}

When utilizing a SAML client the result is a type of Duende.IdentityServer.Saml.Models.SamlAuthenticationContext, whereas an OpenID client returns Duende.IdentityServer.Models.AuthorizationRequest. Both types implement the IAuthenticationContext interface and we believe the GetAuthorizationContextAsync method should cast and return an IAuthenticationContext instead of an AuthorizationRequest.

[wcabus]

Hi @secart, I raised this issue with our engineering team! Thanks for digging into this!

[pgermishuys]

Hi @secart, the SAML documentation has a note about using GetAuthenticationContextAsync on the IIdentityServerInteractionService for your specific scenario. We are reviewing the API and will be considering some adjustments which will improve the developer experience.

For advanced scenarios where your login UI needs access to SAML-specific request details (such as RequestedAuthnContext requirements), call GetAuthenticationContextAsync on IIdentityServerInteractionService and pattern-match on the result to access SamlAuthenticationContext. See Extensibility for details.

[secart]

Thanks @pgermishuys, appreciate the feedback and we have implemented GetAuthenticationContextAsync to retrieve the ServiceProvider and restore the required functionality.