SSO using SAML2.0 on asp.net

Question

My requirement is to implement single sign-on using SAML2.0 on asp.net. I have 2 sellers at my end. I want to transfer the user from one site to another without going to the second. I have never used SAML2.0 before. Can someone help me how can I do this.

Answer 1

First, let's distinguish between a protocol and a token format. I assume that you are talking about a protocol, not a token format. But just in case, there are differences:

• The format of the SAML 2 token is simply the token format that your application will eliminate. It is supported by WIF out of the box.
• SAML 2 protocol. These are HTTP interactions that your application will need to understand in order to receive a token in the application. This is not supported by WIF, but there is an extension that you can download ( http://connect.microsoft.com/site1168/Downloads/DownloadDetails.aspx?DownloadID=36088 )

On the other hand, you have a scenario in which there are several identity providers. The book suggested by Wiktor (which I co-authored) explains this scenario in more detail in the chapter Federated Identity with Multiple Partners . I recommend that you read it to get the concepts behind federation of identity. Let me give you a short version of the article and some implementation details. There are two ways to resolve this issue:

• Implementing it at the application level. WIF allows you to trust more than one identity provider identifier (this is done with X509 certificates). Then you will have to generate login requests for each identity provider depending on the URL (for example, https://idp1.yourapp.com or https://yourapp.com/idp1 ) or the user choosing (having a home page with two links, one for each identity card). You will also have to normalize the claims coming from this identity provider (perhaps one of them will send you the application “name” and the other “upn”).

  YourApp --> Identity Provider 1 \-> Identity Provider 2 

• Using the so-called "federation provider". This is another server that will issue tokens to your application, and it will have a trust relationship with your identity provider. Instead of having your application trust two identity providers, you trust only your federation provider, and the provider will trust the identity providers. This is a chain of trust.

   YourApp --> Federation Provider --> Identity Provider 1 \-> Identity Provider 2 

This architecture allows you to:

• grow identity providers without touching your application.
• If you have a second application, you simply copy your implementation of the first.
• you get single sign-on for free
• you get a complaint conversion mechanism (if you use something like ADFS)
• If you use something like ADFS, you get the built-in SAML 2 protocol (instead of executing it manually using the extension below).

Of course, the disadvantage is that now you have something else to service (ADFS server).

Answer 2

I recommend using the Windows Identity Foundation subsystem, which simplifies SAML authentication.

The topic is quite wide, so you need a good reference and, fortunately, there is one, free from MS:

http://msdn.microsoft.com/en-us/library/ff423674.aspx

In short: in order to transfer an identifier between two servers, one of them must implement the identity provider service (Security Token Service), and the second must accept SAML tokens created and signed by the first.

Answer 3

I would recommend using ComponentSpace. They provide a library for all uses of the SAML 2.0 token and the SAML 2.0 protocol. Currently, WIF does not support SAML 2.0 protocol and token support except CTP.

Answer 4

We wrote a very simple open source C # component for use with ASP.NET applications: https://github.com/jitbit/AspNetSaml (including sample code)

It is very short and simple, but that was the goal. Instead of adding a huge third-party package, just throw one short C # file into your project and you are ready for SAML. This thing has worked for us for years, even on .NET 3.x

[Disclaimer] I am one of the participants.

PS. Forks and contributions are welcome.