在 ASP.Net 应用程序上结合 ADFS 身份验证和 JWT Bearer

Question

I have a web API written in ASP.NET and frontend written in Angular. Authentication on the API side can be configured to use either Windows Authentication, ADFS Authentication or JWT Bearer. But for a particular deployment, only one type of authentication is supported.

For the ADFS authentication I am using angular-oauth2-oidc on the Angular side.

On the API side, this is how I am configuring the ADFS authentication in the startup.cs file.

    public void ConfigureAuth(IAppBuilder app)
    {
        app.UseActiveDirectoryFederationServicesBearerAuthentication
            (new ActiveDirectoryFederationServicesBearerAuthenticationOptions
            {
                BackchannelCertificateValidator = new CertificateValidator(),
                MetadataEndpoint = System.Configuration.ConfigurationManager.AppSettings["ida:ADFSMetadata"],
                TokenValidationParameters = new TokenValidationParameters()
                {
                    ValidAudience = System.Configuration.ConfigurationManager.AppSettings["ida:Audience"],
                    ValidIssuer = System.Configuration.ConfigurationManager.AppSettings["ida:ValidIssuer"]
                },
                Provider = new OAuthBearerAuthenticationProvider()
                {
                    OnValidateIdentity = async context =>
                    {
                        var identity = context.Ticket.Identity;
                        var emailAddress = identity.FindFirst(ClaimTypes.Email).Value;
                        using (AuthRepository repo = new AuthRepository())
                        {
                            var userManager = repo.GetUserManager();
                            var aspNetUser = userManager.FindByEmailAsync(emailAddress).GetAwaiter().GetResult();
                            if (aspNetUser != null)
                            {
                                identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, aspNetUser.Id));
                                await ProfileManager.AddClaimsToIdentity(identity, aspNetUser.SelectedProfile);
                            }
                        }
                    }
                }
            });
    }

What I want is to combine ADFS authentication with JWT Bearer in such a way that if the entered email address is associated with my company domain like "email@mycompany.com", it authenticates against the ADFS and if it's any other email, it uses JWT Bearer authentication.

I know different type of authentications can be combined in ASP.NET Core (example here ) but my API is not built using the Core.

I have tried to find the same feature for ASP.NET but I couldn't find one. I would like to know if this is possible to achieve and if yes, I will really appreciate if someone can give me a pointer.

Answer 1

On this question:

What I want is to combine ADFS authentication with JWT Bearer in such a way that if the entered email address is associated with my company domain like "email@mycompany.com", it authenticates against the ADFS and if it's any other email, it uses JWT Bearer authentication.

As far as I know, it is possible.

Have you tried Microsoft Identity Platform? This is a specific Azure SDK for managing identities, including support for ADFS 3.0 in Windows Server 2012 and later. It is also easier to use, because this MIcrosoft Identity Platform is using OpenIDConnect with OAuth 2.0, therefore you can use ADFS that has JWT bearer.

This is the official docs page: https://docs.microsoft.com/en-us/azure/active-directory/develop/

The landing page has various samples for you to get started. Since you are using .NET Core, the Microsoft Identity Platform SDK has sample that you can use is the sample using .NET Core: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v2-aspnet-core-webapp

This is a github repo that contains various sample beside that tutorial: https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2

UPDATE 1: Current documentation of ADFS in Windows Server 2016 only shows support for OAuth2/OpenIDConnect, and it is using JWT Bearer: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-openid-connect-oauth-concepts

I have searched for specific "ADFS Bearer Token Authentication" in the MS official documentation, and it's not available at all. All of the current doc is mentioning about ADFS 3.0 and later (including ADFS in Windows Server 2016 and 2019) is using OAuth2/OpenIDConnect.