The WIF runtime has limited support for SAML 2.0 specifications. In Chapter 3, Advanced Programming with Windows Identity Foundation, we have seen how we can extend the SAML 2.0 protocol support in WIF to implement SAML 2.0 profiles for web browser SSO. We created Identity and Service Providers to generate and consume SAML 2.0 Response tokens. By popular demand, the Identity and Access Management team at Microsoft has released the SAML 2.0 Extension CTP for WIF. The CTP contains the Microsoft.IdentityModel.Protocols assembly that extends the WIF runtime to provide extensive support for SAML 2.0 specification. It also provides samples, demonstrating the steps to create SP Lite (OASIS SAML v2.0) compliant Service Providers using the extension API. In this recipe, we will explore the steps to create SAML 2.0 compatible Identity and Service Providers using the SAML 2.0 Extension CTP for WIF.
The prerequisites for creating SP Lite compliant applications using the SAML 2.0 Extension CTP are as follows:
- Windows Identity Foundation Runtime for .NET Framework 4.0
- Internet Information Server 7.0
- Windows Server 2008 machine configured with AD FS 2.0 (In our solution we will use the AD FS 2.0 server configured in Chapter 5, Identity Management with Active Directory Federation Services)
Download the SAML 2.0 Extension CTP from http://connect.microsoft.com/site1168/Downloads/DownloadDetails.aspx?DownloadID=36088. Extract the ZIP package to an accessible location to explore the samples. The Microsoft.IdentityModel.Protocols.dll extension assembly is located under the Commonin folder. The Identity and Service Provider samples can be opened and compiled using Visual Studio 2010.
Follow these steps to create a Service Provider using the SAML 2.0 Extension CTP that can consume claims from a SAML 2.0 compliant Identity Provider such as AD FS 2.0:
- Create a new Visual Studio 2010 empty solution and name it
SpLiteSSO. - Add a new Visual Studio C# ASP.NET Web Application project named
ServiceProviderand host it in IIS over HTTPS. - Add a reference to the Microsoft.IdentityModel and Microsoft.IdentityModel.Protocols (from the extracted Extension CTP zip package's
Commoninfolder) assemblies, as shown in the following screenshot:
- Open the
SamlConfigToolsolution from theCommonSamlConfigToolfolder under the extracted package. Compile the solution. Copy theSamlConfigTool.exeand theMicrosoft.IdentityModel.Protocols.dllfiles from thebinfolder and place it under theServiceProviderproject root folder. - Run
SamlConfigTool.exe. - In the
SamlConfigToolconsole, enter theServiceProviderapplication URL as the Entity ID and SAML endpoint under the Relying Party Information step. Hit enter. Select the Signing and Encryption certificates:
- In the Identity Provider Information step, specify the AD FS 2.0 Federation Metadata URL (configured in Chapter 5, Identity Management with Active Directory Federation Services) as the partner's metadata URL:
SamlConfigToolgenerates a few files in theServiceProviderapplication. First is theChanges_To_Web-Config.xmlfile. This file specifies all the changes required in theServiceProviderproject'sWeb.configfile. Make the necessary changes in theWeb.configfile as specified, that includes adding theSaml2AuthenticationModule HttpModuleand themicrosoft.identityModel.samlconfiguration sections:
- The sections shown in the following screenshot will be required to be added to the
Web.configfile:
- The sections shown in the following screenshot will be required to be added to the
- A Federation metadata file for the
ServiceProviderapplication is also generated bySamlConfigTool. Use this file to add theServiceProviderapplication as a Relying Party Trust in AD FS 2.0 (follow the steps discussed in Chapter 5, Identity Management with Active Directory Federation Services). Now, you have successfully configured theServiceProviderapplication to consume SAML 2.0 tokens issued by AD FS 2.0.
When you launch the ServiceProvider application you will be redirected to AD FS for authentication. SamlConfigTool in conjunction with Saml2AuthenticationModule allows identity developers on .NET applications to easily configure support for SAML 2.0 Identity Providers such as AD FS 2.0.
The default ASP.NET Web Application comes with an implementation of authentication. You can override the default sign-in and sign-out experience with the Saml2AuthenticationModule methods. For example, the SignIn button-click event handler could implement the following code:
Saml2AuthenticationModule.Current.SignIn("~Default.aspx");