ADFS2016 SAML2 to OAUTH2/OIDC

Question

We have an MVC application (<myapp.somedomain.com>) .net 4.5.2 (OWIN/ADAL) that uses ADFS2016 for AuthN/AuthZ via OIDC/OAuth2. Users' credentials and attributes are stored in AD LDS. A client (X) requested to authenticate in the application via their IdP over SAML2. Is this possible WITHOUT making changes to the application?

The flow I am looking for; for this client the app's URL would be (<myapp.somedomain.com/?client=x>). Our ADFS would recognize and redirect the client to their IdP where they would authenticate and than they would be send back to our ADFS along with some predefined claims. Our ADFS would map these claims to an Id Token / Access Token for our application to use. Am I dreaming or is this indeed feasible?

Any links to articles / documentation on how this could be achieved would be most helpful.

Answer 1

As @Wiktor suggests, you could add a SAML client-side stack to your app.

The other way is to federate ADFS with the SAML IDP.

When the user is redirected to ADFS, they use Home Realm Discovery to either redirect to the SAML IDP or authenticate on ADFS directly.

ADFS should handle the token conversions but you may have to fiddle around with the claims rules.