Search code examples
securityauthenticationowinkatanaws-federation

Changing ReturnUrl in OWIN RedirectToIdentityProvider notification

We are currently overriding WSFederationAuthenticationModule.RedirectToIdentityProvider in our product to change the returnUrl to which the users agent is redirected to after authentication.

Now we're in the proces of adopting OWIN (Katana) middleware instead of HttpModules. In the RedirectToIdentityProvider notification in WsFederationAuthenticationOptions, I see the WCtx parameter now contains a WsFedOwinState parameter which is encrypted using DPAPI.

How do I implement the RedirectToIdentityProvider action to change the return URL? Do I need to decrypt the WsFedOwinState parameter to add the returnUrl query parameter or is there some other way?

Solution

  • inside RedirectToIdentityProvider, you will have access to the WsFederationMessage.

    Set the Wreply property to the value you need.

    As a note: MachineKey is used by default, not DPAPI for protecting wctx.