如何在 MVC 应用程序中将 ASP.NET 成员资格迁移到 SAML？

Question

I want to migrate the ASP.NET membership authentication/authorization of an MVC application into SAML.

Could you please provide any suggestions or links that can guide me on implementation.

I know we can use Azure App Proxy and SAML SSO for on-premise applications.

But On-premise MVC application has ASP.NET Membership implemented for Role authorization and LDAP for authentication.

How can we convert it to enable SAML. Do we need any code change.

Kindly suggest.

Answer 1

ASP.NET membership does everything inside the application using a database.

So authentication and authorisation are both handled by the membership provider.

In SAML, this is outsourced to the SAML provider.

On login, the application redirects to the IDP where the user authenticates and then a SAML token is returned that contains the SAML assertions ie claims some of which may be roles.

So you may have to migrate the users to the SAML IDP. If they are already there, use the NameID claim in the assertion to match against the user in the database.

To talk to the SAML IDP, you need to add a SAML client side stack .