如何将Azure AD身份验证添加到现有的.net网站

Question

I have an existing .net web forms site using ADFS authentication ( System.IdentityModel.dll ) with different custom domains, one for each customer. In the Global.asax.cs I redirect users to their corresponding ADFS endpoint.

void WSFederationAuthenticationModule_RedirectingToIdentityProvider(object sender, RedirectingToIdentityProviderEventArgs e)
{
  if (org == "customername1")
  {
    strWhr = "http://adfs.customername1.com/adfs/services/trust";
    e.SignInRequestMessage.HomeRealm = strWhr;
  }
}

Now I need to add Azure AD authentication, cannot use the Visual Studio wizard as authentication is been already set.

Is there any way I can reuse what I have and redirect users their corresonding Azure AD, as setting the HomeRealm to https://login.windows.net/tenatName ?

I won't like to add a trust between ADFS and each new customer Azure AD, at least from now, I would like to have ADFS and Azure AD authentication at same time if possible.

Sites created through VS using Organizational Accounts authentication does the authentication configuration in the Startup.Auth.cs file, is this something I'll have to do together with using Owin dlls ?

Answer 1

The standard way is via OWIN. Refer this .

Looks like you are using WS-Fed.

I can't think of a reason why WIF won't work but I don't know of a sample for this.

Answer 2

I would like to have ADFS and Azure AD authentication at same time if possible.

The way Azure AD is designed right now, the mix of the above would only work if the Application is also running as a Azure cloud based service. Here is what the link says.

"Extend Active Directory and any other on-premises directories to Azure AD to enable single sign-on for all cloud-based applications."

https://azure.microsoft.com/en-us/services/active-directory/

I am assuming that your application is running on the premise, which would mean, you may not be able to mix them up.

Answer 3

Not really answer to my question as I'll create a new project and copy web pages content. I'm testing a potential solution, doesn't looks nice but it works. It might be another nicer way to do it, so I'm open to inputs.

if (org == "customername1")
{
app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
{
    Wtrealm = realm,
    MetadataAddress = adfsMetadata,
});
}
else if (org == "customername2")
{
app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    ClientId = clientId,
    Authority = authority,
    PostLogoutRedirectUri = postLogoutRedirectUri,
}

What I do is to use WSFederation or OpenId protocols depending on the URL the user is loginin. It keeps the session with the cookie OWIN creates, so testing I've done so far looks promising. To get this code, just create one project with ADFS authentication and other with Azure AD, then add missing nuget packages to the solution and copy code in StartupAuth.cs from one to another.