How to call RESTFul WCF service with Forms authentication

Question

Assumptions:

Client is a Web application (ASP.NET) configured for STS Passive Issue Server is a MVC Application with 2 services (1. Issues a token and other gets metadata) Server on the other hand configured for Forms authentication and should redirect to Login page if unauthenticated access is made.

Workflow:

1. end user tries to load client.
2. It contact the STS by redirecting to the STS server.
3. The server is configured with Forms authentication with a redirect URL.

But Server does not redirect to login page. instead it allows to call the Issue end point.

I tried to restrict via authorization tag in web.config. Also, i tried location tag to set authorization explicitly. But it still allows the call.

i referred many blogs

How to: Enable the WCF Authentication Service

How to: Customize User Login When Using the WCF Authentication Service

But no luck.

Answer 1

This is easy to achieve with ADFS. Use the following steps if ADFS is your STS:

1. Navigate to the folder where ADFS web application is located (normally C:\\inetpub\\adfs\\ls)

   2. Make a copy of the current web.config for safety

   3. Open web.config in notepad

   4. Locate

   5. In , change the order of authentication to assure that it lists Forms Authentication first

   6. The order must look like this:

    <add name="Forms" page="FormsSignIn.aspx" /> <add name="Integrated" page="auth/integrated/" /> <add name="TlsClient" page="auth/sslclient/" /> <add name="Basic" page="auth/basic/" /> 

   7. Save the changes (you do not need to restart ADFS)

   8. Navigate to your application and click on Login. Instead of sending the login request to ADFS, a page containing a login dialog will pop up. Please enter your credential and click ok. Then, you will get the same result as above.

Reference articles:

Claims Aware MVC4 App using WIF Identity and Access tool in .Net 4.5 Part I

Claims Aware MVC4 App using WIF Identity and Access tool in .Net 4.5 Part II