如何从 ADFS 服务器获取 SAML 令牌以从 C# 中的动态 CRM 本地（非 sdk）中提取数据？

Question

I have tried to get a SAML token from ADFS to pull data from on-premises CRM (non-sdk), but I don't know how..I think I need to make a SOAP request to ADFS to get a SAML token by using postasync method, and then I think I need to put the token in a http header like below to pull data from CRM.

httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", TOKEN);

https://docs.microsoft.com/en-us/previous-versions/dynamicscrm-2016/developers-guide/gg327838(v=crm.8)

https://community.dynamics.com/crm/f/microsoft-dynamics-crm-forum/255985/crm2016-afds-authentication

https://gist.github.com/jlattimer/7b0ee146badfc57fc9c9

I have read those three links above (and other stuff), and tried them but it seems like the first two work only for sdk, not non-sdk. And, the github stuff didn't work for me, either. And I wonder if there is another way to generate a SOAP request instead of typing in everything like in the third link.

Answer 1

There is two ways, which I know. In both ways you need to add your app as RPT to ADFS. Check this: https://docs.microsoft.com/ru-ru/windows-server/identity/ad-fs/operations/create-a-relying-party-trust Don't forget to enable saml protocol and set assertion consumer endpoint.

Solution one:

Just redirect all unauthorized users to https://your.adfs.instance/adfs/ls/IDpInitiatedSignon.aspx They will provide credentials and then will be asked to choose app for redirect. If you will specify app using Relay state in url there will be no choice. After that ADFS will send SAML response to endpoint, which was specified for RPT. If you use .NET, you can use WS-Fed module, which will automate this dataflow.

Solution two:

You can do the same on your backend. Thisis realization for .NET: https://blogs.msdn.microsoft.com/rodneyviana/2014/04/21/how-to-get-a-saml-protocol-response-from-adfs-using-c/

Also, you can make direct calls to ADFS, it'sa bit more native, but I don't guarantee that it will be SAML tokens. Here is example: Authentication in C# with Active Directory

UPD. I read your question again and not sure, that it is what you need.

Answer 2

ADFS is an Identity Provider (IDP) and implements:

• OpenID Connect
• WS-Fed
• SAML

Your client has to implement one of these three protocols.

You can't use SOAP.

For OpenID Connect (OIDC), you can use a REST API but that gives you a JWT, not a SAML token.

Once you have the access token via OIDC, you add it as ("Bearer", TOKEN) as you describe.

Good overview and samples .