How to Retrieve Claims from Idp-Initiated Login Using Sustainsys Saml2?

Question

I am trying to add support for SAML authentication to an ASP.NET Core MVC application with ASP.NET Core Identity (not IdentityServer). The flow "works" when testing with StubIdp - the SAMLResponse is POSTed to /Saml2/Acs and I'm redirected to the app with an Identity.External cookie, but my ClaimsPrincipal is empty and unauthenticated. Even if I use the NameID of a user who already exists in the database, the claims are completely empty.

I also see the following in the console log:
Sustainsys.Saml2.AspNetCore2.Saml2Handler: Information: Successfully processed SAML response Microsoft.IdentityModel.Tokens.Saml2.Saml2Id and authenticated JohnDoe

I installed the Sustainsys.Saml2.AspNetCore2 package, and added the service configuration to startup.cs as follows:

services.AddAuthentication()
                .AddSaml2(async options =>
                {
                    var azureServiceTokenProvider = new AzureServiceTokenProvider();
                    var keyVaultClient = new KeyVaultClient(
                        new KeyVaultClient.AuthenticationCallback(
                            azureServiceTokenProvider.KeyVaultTokenCallback));

                    var certificateSecret = await keyVaultClient.GetSecretAsync($"https://{Configuration["KeyVaultName"]}.vault.azure.net/", Configuration["ServiceProviderCertName"]);
                    var privateKeyBytes = Convert.FromBase64String(certificateSecret.Value);

                    options.SPOptions.EntityId = new EntityId(Configuration["BaseUrl"] + "/Saml2");
                    options.SPOptions.ReturnUrl = new Uri(Configuration["BaseUrl"]);

                    IdentityProvider idp = new IdentityProvider(
                            new EntityId("https://stubidp.sustainsys.com/Metadata"), options.SPOptions)
                    {
                        LoadMetadata = true,
                        MetadataLocation = "https://stubidp.sustainsys.com/Metadata",
                        AllowUnsolicitedAuthnResponse = true
                    };

                    options.IdentityProviders.Add(idp);

                    options.SPOptions.ServiceCertificates.Add(new X509Certificate2(privateKeyBytes));
                });

Configuration["BaseUrl"] is the base URL of my app, in this case a localhost port.

I'm obviously missing something, but I can't figure out what. Do I need to somehow explicitly connect/map the Saml2 service to ASP.NET Core Identity?

Answer 1

Was able to resolve this based on comments in this GitHub issue.

My comment explaining how I was able to implement the workaround: https://github.com/Sustainsys/Saml2/issues/1030#issuecomment-616842796