WebAPI using Thinktecture does not process SAML token in header from active client

Question

I have created an ASP.NET WebAPI project which uses claims based authentication with WIF. I am also using Thinktecture Identity Server which is hosted on local IIS to act as an STS. Everything works fine from the browser; I am redirected to the log in page and can see the correct identity present in Thread.CurrentPrincipal.Identity inside one of my REST API controllers.

My problem is that I cannot figure out how to get an active client to authenticate. I have spent hours searching and reading and cannot get this to work. It's like my WebAPI just never even looks at the HTTP header. I tried creating my own IHttpModule to intercept the request and can see my SAML token in the header. The response I get in my client is the log in page that the user would normally get redirected to if using the browser. I have also tried everything mentioned in this question.

My active client looks like this:

static void Main(string[] args)
{
    string token = GetSamlToken();
    CallService(token);
}

static Uri _baseAddress = new Uri("http://localhost:50565/");
static string _realm = "http://localhost:50565/";

private static string GetSamlToken()
{
    var factory = new WSTrustChannelFactory(
        new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential), "https://localhost/idsrv/issue/wstrust/mixed/username");
    factory.TrustVersion = TrustVersion.WSTrust13;

    factory.Credentials.UserName.UserName = "bob";
    factory.Credentials.UserName.Password = "p@assword";

    var rst = new RequestSecurityToken
    {
        RequestType = RequestTypes.Issue,
        KeyType = KeyTypes.Bearer,
        TokenType = TokenTypes.Saml2TokenProfile11,
        AppliesTo = new EndpointReference(_realm) 
    };

    System.Net.ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };

    var token = factory.CreateChannel().Issue(rst) as GenericXmlSecurityToken;
    return token.TokenXml.OuterXml;
}

private static void CallService(string token)
{
    var client = new HttpClient
    {
        BaseAddress = _baseAddress
    };

    client.SetToken("SAML", token); //Constants.IdSrv.SamlScheme

    while (true)
    {
        "Calling service.".ConsoleYellow();

        var response = client.GetAsync("api/values").Result;

        response.EnsureSuccessStatusCode();

        var content = response.Content.ReadAsStringAsync();
        content.Wait();

        Console.WriteLine(content.Result);

        Console.ReadLine();
    }
}

the relevant part of my web.config looks like this:

<configuration>
  <configSections>
    <section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
    <section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
  </configSections>
  <location path="FederationMetadata">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <appSettings>
    <add key="ida:FederationMetadataLocation" value="https://localhost/idsrv/FederationMetadata/2007-06/FederationMetadata.xml" />
    <add key="ida:Issuer" value="https://localhost/idsrv/issue/wsfed" />
    <add key="ida:ProviderSelection" value="productionSTS" />
  </appSettings>
  <system.web>
    <authorization>
      <deny users="?" />
    </authorization>
    <authentication mode="None" />
  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <modules runAllManagedModulesForAllRequests="true">
      <remove name="FormsAuthentication" />

      <add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
      <add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" />
    </modules>
    <handlers>
      <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
      <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
      <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
      <remove name="WebDav" />
      <add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
      <add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
      <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
  </system.webServer>

  <system.identityModel>
    <identityConfiguration>
      <securityTokenHandlers>
        <add type="System.IdentityModel.Tokens.SamlSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add type="System.IdentityModel.Tokens.Saml2SecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
      </securityTokenHandlers>
      <audienceUris>
        <add value="http://localhost:50565/" />
      </audienceUris>
      <certificateValidation certificateValidationMode="None" />
      <claimsAuthorizationManager type="MvcApplication1.Claims.CustomAuthorizationManager, MvcApplication1" />
      <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
        <authority name="http://identityserver.v2.thinktecture.com/samples">
          <keys>
            <add thumbprint="E590FF943557129F13F0DF618EC8B23B88983110" />
          </keys>
          <validIssuers>
            <add name="http://identityserver.v2.thinktecture.com/samples" />
          </validIssuers>
        </authority>
      </issuerNameRegistry>
    </identityConfiguration>
  </system.identityModel>
  <system.identityModel.services>
    <federationConfiguration>
      <cookieHandler requireSsl="false" />
      <wsFederation passiveRedirectEnabled="true" issuer="https://localhost/idsrv/issue/wsfed" realm="http://localhost:50565/" requireHttps="false" />
    </federationConfiguration>
  </system.identityModel.services>
</configuration>

I have also added the AuthenticationHandler in my WebApiConfig.cs like this (based on this and also the other SO question I mentioned):

var authentication = CreateAuthenticationConfiguration();
config.MessageHandlers.Add(new AuthenticationHandler(authentication));

private static AuthenticationConfiguration CreateAuthenticationConfiguration()
{
    var authentication = new AuthenticationConfiguration
    {
        ClaimsAuthenticationManager = new ClaimsTransformer(),
        RequireSsl = false,
        EnableSessionToken = true
    };

    #region IdentityServer SAML
    authentication.AddSaml2(
        issuerThumbprint: "E590FF943557129F13F0DF618EC8B23B88983110",
        issuerName: "https://localhost/idsrv/issue/wsfed",
        audienceUri: "http://localhost:50565/",
        certificateValidator: System.IdentityModel.Selectors.X509CertificateValidator.None,
        options: AuthenticationOptions.ForAuthorizationHeader("SAML"),
        scheme: AuthenticationScheme.SchemeOnly("SAML"));
    #endregion

    #region Client Certificates
    authentication.AddClientCertificate(ClientCertificateMode.ChainValidation);
    #endregion

    return authentication;
}

It seems to me like the WSFederationAuthenticationModule is intercepting the request first and then just redirecting to the STS login before the AuthenticationHandler has a chance to look for the SAML token present in the header. Can anyone see anything wrong or missing with my configuration?

Answer 1

Try removing the

  <authorization>
      <deny users="?" />
    </authorization>

From the system.web section of your web config. I'm not sure about SAML, but I achieve this relatively easily with a JWT, and I think for REST based clients that's a better choice than SAML.