使用ADFS 2.0和SAML 2.0进行Web SSO时，我的asp.net网站是否需要重定向到IdP服务器吗？

Question

My asp.net web site is .NET 4.5, we get metadata.xml file from the partner company and gave them also our metadata.xml file. they say that they use SAML 2.0 so i am a little beat confuse but i guess we fall to the Ws-Federation scenario for authenication (and NOT Web SSO SAML Protocol). we want to implement SP-Initiated :

1. Does my asp.net web site default page need to do redirect to IdP server when doing web sso with ADFS 2.0 and SAML 2.0 or maybe it done by the ADFS infra?
   (the Idp server is also ADFS2.0+SAML2.0)

2. Does my asp.net web site need to do make a logout request to do the IdP server?

3. Does my asp.net web site default page just need to extract the claims from the http user context and take for example the user email address and mark this user as logged in?

Answer 1

SP Initiated is SAML not WS-Fed so you need to go the SAML protocol route.

Easiest way is to use WIF (older technology) or the newer OWIN WS-Fed libraries on the ASP.NET application side.

This will then do all the redirection to ADFS for you.

It will return a Claims Principal which will contain all the claims.

Answer 2

1. yes (You need to be redirected on IDP server to enter the credentials)
2. yes (Logout request should be made to IDP server as well)
3. I'm not sure about the net application but according to SAML specification you will receive a response from IDP and you need to check if logout was successful or not.