How to use saml sso with webforms

Question

I have a website webforms and I need to integrate the saml sso authentification. I searched a long time for any information but there is so different stuff about that I can't identify properly the right things to do.

What i can say is that I have a federationMetadata xml file and i'm asking if I have all the information needed with it or if I need more information to achieve the authentification sso.

What i understood is :

I have to post an assertion request with some parameters. I don't understand some parameters and try to find them into the federationmetadata.xml file. Like the issuer ? How to use the signin key ? use the encryption ? Must I develop an idp and wich tool must i use (sustainsys for exemple) I'm totally lost

Thank you for your help.

Answer 1

The SAML metadata should include all the configuration information you require from the service provider. Similarly, your identity provider metadata should be all the configuration information required by the service provider.

The issuer field in SAML messages corresponds to the entity ID in the metadata.

I recommend looking at the open source and commercial products available rather than developing your own identity provider.

Answer 2

Your question is a little fuzzy but I would like to help clarify some things. You may have made progress by now.

First you're using WIF and need at least the WIF runtime installed. It comes with the WIF SDK. You're going to use the FedUtil tool

You need the metadata file either as a file or at a URL which you can use to configure your side of the configuration. There are two instances of metadata.

1. The metadata describing where the authentication / login occurs. This is what the FedUtil tool will inspect and will use this to know what claims are available (claims are the various bits of user information available to the web application from the successful login).

2. The Metadata generated by the FedUtil tool which describes the web application on your side, so that the authentication side can be configured.

Note this metadata exchange happens in advance as a part of deployment and when certificates expire must be updated.

The FedUtil tool configures the web.config file so that access to the whole site is taken care of, so you can't access the site without first authenticating successfully. If you're using the standard asp.net identity stuff then you can access the logged in user's details otherwise you can access claims directly.

You don't need to do any assertion stuff yourself. This is all we needed to determine who had logged in: (note "usercode" is a claim provided to us).

(System.Security.Claims.ClaimsPrincipal)System.Threading.Thread.CurrentPrincipal).Claims.Where(x => x.Type == "usercode").Select(x => x.Value).FirstOrDefault();

Also note the list of claims in the web.config does not have any impact on the system it's just there for reference and for the fedutil tool to use again I think.

Hopefully this helps.