Configure STS but save formauthentication in webapp

Question

I can create a Windows authentication framework in an existing webapp.

I want to spoil as much as possible with the existing code, so I would like the login page that uses formal authentication to remain in the application, and I just connect to STS if the user enters the application through a specific page, for example, "im_comming_from_some_other_site ".aspx".

in "im_comming_from_some_other_site.aspx" the code will look like this:

Page_Load(...) { if(verifyAgainstSTS() { FormsAuthentication.SetAuthCookie(<some_STS_Userid), ...) Response.Redirect("default.aspx") } else { Response.Redirect("http://<STS_server_name/<STS_service...etc>") } } 

Is there anyone who knows if this can be done and how? Any links to sample code (if any) are deeply appreciated.

(Of course, to determine what to do when the timeout is checked, some code will be required, or go to the local login page or the STS login page)

I know this may seem like a poor design, not completely with STS, but I need to implement this as soon as possible, and I want the source site to be as untouched as possible.

Answer 1

This is not a bad design, this is your requirement, and you are trying to fulfill it. We have a working system built in this way, and this is not rocket science. The only difference is that we switch it to / sam forms statically (using global settings), and not dynamically.

In any case, you save the authentication of your forms in web.config so that in the absence of authorization for the current user, the forms redirect the request to the login page.

On the login page, you have two options. One of them creates cookie forms. Another option involves managing WIF FederatedPassiveSignIn .

If the user monitors forms authentication, the cookie is set and everything is ready. If the user follows the STS control, sooner or later he will return with a valid SAML token. FederatedPassiveSignIn will automatically pick it up and you simply handle the redirect in the SignedIn event.

You don’t even need the if you mentioned in your question.

There is one caveat from what I remember. When a user authenticates with STS, a WS-Federation cookie is created, you can read statements, etc. Everything works.

However, if the user is authenticated by forms, SAM (SessionAuthenticationModule) will WRITE cookies of WS-federation form files in the ASP.NET pipeline at the request of EACH (I assume because SAM is later in the pipeline that forms the authentication module).

This DOESN'T LET IN your context.User.Identity.IsInRole(...) , also authorization works correctly, because SAM copies user roles to the corresponding statements.

However, if anywhere in your code you are trying to extract information directly from a forms cookie (instead of using the common APIs), you may find out that cookies are not present even if the user has been authenticated by forms in the first place (and there is no cookie because it will be replaced by the WS-Federation cookie).