Changing ReturnUrl in OWIN RedirectToIdentityProvider notification

Question

We are currently overriding WSFederationAuthenticationModule.RedirectToIdentityProvider in our product to change the returnUrl to which the users agent is redirected to after authentication.

Now we're in the proces of adopting OWIN (Katana) middleware instead of HttpModules. In the RedirectToIdentityProvider notification in WsFederationAuthenticationOptions , I see the WCtx parameter now contains a WsFedOwinState parameter which is encrypted using DPAPI.

How do I implement the RedirectToIdentityProvider action to change the return URL? Do I need to decrypt the WsFedOwinState parameter to add the returnUrl query parameter or is there some other way?

Answer 1

inside RedirectToIdentityProvider, you will have access to the WsFederationMessage.

Set the Wreply property to the value you need.

As a note: MachineKey is used by default, not DPAPI for protecting wctx.

Answer 2

In my case, I changed the return URL in SecurityTokenValidated and had the redirection from ADFS always go to the same URL

 public void ConfigureAuth(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(WsFederationAuthenticationDefaults.AuthenticationType);

    app.UseCookieAuthentication(new CookieAuthenticationOptions { AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType });

    app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
    {
        Wtrealm = realm,
        MetadataAddress = adfsMetadata,
        Notifications = new WsFederationAuthenticationNotifications
        {
            SecurityTokenValidated = nx =>
            {
                nx.AuthenticationTicket.Properties.RedirectUri = "/RedirectionGoesHere.aspx";
                return Task.FromResult(0);
            }
        }
    });
    // This makes any middleware defined above this line run before the Authorization rule is applied in web.config
    app.UseStageMarker(PipelineStage.Authenticate);
}