从ADFS Single Sign On读取cookie

Question

Good morning,

On my test-site I implemented SSO (SAML2.0 from ComponentSpace) which works great, but the next level - live situation- is giving me a headache…

My customer is using ADFS for authentication and when a user accesses my site (in the cloud) for the first time, my site generates a nice SAML-request which is answered with a SAML-response from ADFS. The user is logged-in. All well so far.

But, when the users accesses my site for the second time ADFS does not response anymore to my SAML-request. After digging into this situation it seems that ADFS saves the first time several cookies on the client webbrowser (under its own domain-name) and when ADFS detects those 4 cookies the second time it does not respond to my SAML-request.

I searched several sites and found a good document about this behaviour on https://msdn.microsoft.com/nl-nl/en%C2%ADus/library/bb897402 . The solution in this article is based on AzMan, but we use the latest Windows server 2012R2 which AzMan is deprecated.

So how do I deal with this situation?

1. How can I detect and read from my domain the cookies from the adfs.customerdomainname.nl?
2. The cookies are encrypted. How can I decrypt them, to get the right UserId from it?
3. Is there a good sample on how to implement SSO in combination with ADFS?

Any help is appreciated!

Thanks,

best regards, Arno

Answer 1

I'd similar issue while authenticating users with ADFS 3.0 from a C# MVC web application. The reason was that while cookies are still active (not-expired) they cannot be overwritten so to fix this issue I created a new CookieManager instead of using the default one. Below is the line of code that worked for me.

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            CookieManager = new SystemWebCookieManager()
        });