I'm trying to adapt the configuration of the ITfoxtec sample application TestWebAppCore from
https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/tree/master/test/TestWebAppCore
to use a SAML-configured Enterprise Application on Azure AD.
In appsettings.json I configured "IdPMetadata" with the metadata URL for the Enterrise Application in Azure AD, of this kind: "https://login.microsoftonline.com/9...3/federationmetadata/2007-06/federationmetadata.xml?appid=c..."
and I have not changed the other lines:
"SignatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
"SigningCertificateFile": "itfoxtec.identity.saml2.testwebappcore_Certificate.pfx",
"SigningCertificatePassword": "!QAZ2wsx",
//"SignatureValidationCertificateFile": "xxx.cer",
"CertificateValidationMode": "None", // "ChainTrust"
"RevocationMode": "NoCheck"
What are the "right" configuration that must be applied in the sample web app and on the Azure AD SAML configuration panel "Azure AD-side" ? In Azure AD SAML specially for the configuration items:
Reply URL (Assertion Consumer Service URL), I tried "https://localhost:44306/"
and
Sign on URL: I tried "https://localhost:44306/Auth/AssertionConsumerService"
but also after a "Login" (with my Azure credentials) the "users Claims" are not visible in the Home Page of the web application.
Thanks all.
Now I have fixed my implementation of the "TestWebAppCore" sample in ITfoxtec.Identity.Saml2.
These are the settings in the Azure AD administration console:
Identifier (Entity ID): itfoxtec-testwebappcore
Reply URL (Assertion Consumer Service URL):
https://localhost:44306/Auth/AssertionConsumerService
Sign on URL, Relay State and Logout Url not configured.
And these are the configurations in appsettings.json:
"Saml2": {
"IdPMetadata": "https://login.microsoftonline.com/9...3/federationmetadata/2007-06/federationmetadata.xml?appid=c...8",
"Issuer": "itfoxtec-testwebappcore",
"SingleSignOnDestination": "https://login.microsoftonline.com/9...3/saml2",
"SingleLogoutDestination": "https://login.microsoftonline.com/9...3/saml2",
"SignatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
"SigningCertificateFile": "itfoxtec.identity.saml2.testwebappcore_Certificate.pfx",
"SigningCertificatePassword": "!QAZ2wsx",
"CertificateValidationMode": "None", // "ChainTrust"
"RevocationMode": "NoCheck"
}
I compiled with .NET 5.0.
Note that in AuthController.cs I have commented the line
NameIdPolicy = new NameIdPolicy { AllowCreate = true, Format = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" },
otherwise the user name presented in the "Secure" page is an ID (in "persistent" format) and not the username with email. As an alternative it is possible to change the line with this one:
NameIdPolicy = new NameIdPolicy { AllowCreate = true, Format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" },
Another good example that use the same ITfoxtex SAML identity library is this one:
https://github.com/nickgamb/Okta_SAML_Example (see also the article https://developer.okta.com/blog/2020/10/23/how-to-authenticate-with-saml-in-aspnet-core-and-csharp).
Related
I am trying to run the WebApp B2C sample:
https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC/1-5-B2C
When I try to login, I get the following error:
IDX40002: Microsoft.IdentityModel does not support a B2C issuer with 'tfp' in the URI. See https://aka.ms/ms-id-web/b2c-issuer for details.
If I edit the Instance to https://myHost.b2clogin.com I get:
AADSTS50011: The redirect URI 'https://myHost.b2clogin.com/1c2009bb-7e35-4a0e-9f22-xxxxxxxxx/oauth2/authresp' specified in the request does not match the redirect URIs configured for the application 'c24b0337-0bd9-45ee-8376-xxxxxxxxx'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.
Edit:
These are my redirects:
I tried to reproduce the same in my environment and got the below results:
I deployed custom policy starter pack via IEF Setup App by entering my Azure B2C tenant name like below:
When I checked that in Portal, custom policies are created successfully like below:
Now I registered one Azure AD B2C app named webapp1 as below:
I added redirect Uri to the above application like below: https://localhost:44316/signin-oidc
Now, I followed the same link that you mentioned and deployed one sample B2C web application by modifying appsettings.json file like below:
"AzureAdB2C": {
"Instance": "https://sridevib2c.b2clogin.com",
"ClientId": "9986e76d-bxx7-4x6x-bxx7-3d8xxxxx9a45",
"Domain": "sridevib2c.onmicrosoft.com",
"SignedOutCallbackPath": "/signout/B2C_1A_SIGNUP_SIGNIN",
"SignUpSignInPolicyId": "B2C_1A_SIGNUP_SIGNIN",
"ResetPasswordPolicyId": "B2C_1A_PASSWORDRESET",
"EditProfilePolicyId": "B2C_1A_PROFILEEDIT" // Optional profile editing policy
//"CallbackPath": "/signin/B2C_1A_SIGNUP_SIGNIN" // defaults to /signin-oidc
},
JSON file:
When I ran the above web application, it took me to below web page:
After selecting Sign Up/In, I got the login screen like below:
When I entered my credentials, I logged in to the application successfully like below:
When I clicked on Sign Out, it showed me below screen by signing me out:
After a long research I found this article/sample, where the Microsoft.Identity.UI framework is replaced with the Microsoft.AspNetCore.Authentication.AzureADB2C.UI.
However, with the https://myDomain.b2clogin.com url I still get the same error, using the custom domain it works, that's enough for me.
I've built a basic Vue web app using Azure Static Web Apps, and I'm trying to configure custom authentication. I've already managed to get everything (mostly) working using Auth0 by following the documentation and referencing this handy blog post.
For Auth0, I added AUTH0_ID=<my-auth0-id> and AUTH0_SECRET=<my-auth0-secret> to the local.settings.json file. My staticwebapp.config.json looked like this:
...
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"auth0": {
"registration": {
"clientIdSettingName": "AUTH0_ID",
"clientCredential": {
"clientSecretSettingName": "AUTH0_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration": "https://<my-auth0-tenant>/.well-known/openid-configuration"
}
},
"login": {
"nameClaimType": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
"scopes": ["openid", "profile"]
}
}
}
}
}
I'm now trying to set up authentication using Azure AD B2C. My understanding is that Azure Static Web Apps handles a portion of the authentication such that I should configure the ID provider to work with a web app rather than with a single page app framework. This is what I did when using Auth0 and it seemed to work.
I've added AADB2C_ID=<my-azure-ad-b2c-id> and AADB2C_SECRET=<my-azure-ad-b2c-secret> to the local.settings.json file. In staticwebapp.config.json I replaced ClientIdSettingName to AADB2C_ID, clientSecretSettingName to AADB2C_SECRET, and wellKnownOpenIdConfiguration to https://<my-azure-ad-b2>.b2clogin.com/<my-azure-ad-b2c>.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_signupsignin1. This references the 'signupsignin' user flow on my B2C tenant.
At this point I can visit /login which points to /.auth/login/aadb2c, initiates the user flow, and lets me sign up and verify as expected. The test user is then created in my Azure AD B2C tenant. However, B2C then tries to redirect me to /.auth/complete which throws a 403 error:
We need an email address or a handle from your login service. To use
this login, please update your account with the missing info.
I've tried adding /.auth/complete as an allowed redirect URI in Azure AD B2C but this doesn't fix things. What am I missing here?
Try changing to this: "nameClaimType": "emails".
Sourced from staticwebapp.config.json in here: https://github.com/Azure/static-web-apps/issues/457
In my IS4's Startup.cs:
services.AddAuthentication()
.AddMicrosoftAccount(o =>
{
o.SignInScheme = IdentityServer4.IdentityServerConstants.ExternalCookieAuthenticationScheme;
o.ClientId = "clientId";
o.ClientSecret = "clientSecret";
});
I have defined the scope:
openid
profile
And I get the error after I tried to login:
unauthorized_client: The client does not exist or is not enabled for consumers. If you are the application developer, configure a new application through the App Registrations in the Azure Portal at https://go.microsoft.com/fwlink/?linkid=2083908.
It's a web app. So what am I doing wrong here:
I assume the client ID is this:
And my client secret is this:
I have also set up the redirect URI:
The error means the Supported account types are not set for the personal account(Microsoft account in your case).
To solve the issue, navigate to the Manifest of your App registration, set the two properties accessTokenAcceptedVersion and signInAudience like below.
"accessTokenAcceptedVersion": 2,
"signInAudience": "AzureADandPersonalMicrosoftAccount"
When you save the setting, make sure your app meets the requirement of the validation, otherwise there will be some errors.
I am following azure AD B2C auth example which runs fine on local changing appsettings.json to my webapp tenant/app. When I publish to azure the home webpage opens but at pressing Login I don't get to the authorisation window, Fiddler shows:
redirect_uri_mismatch
AADB2C90006: The redirect URI
'https://webappname.azurewebsites.net/signin/B2C_1_mysigninoutpolicy' provided in the request is not registered for the client id 'xxxxxxxx'.
The user flow policies are registered:
I think this setup is b2login.com compliant.
a) I create tenant and register the app in portal. At the tenant:
Azure AD B2C resource name (tenant): tenantName.onmicrosoft.com
I set App Registration->Reply URL https://webappname.azurewebsites.net/signin-oidc
Also on App Registration->Add ID URI (optional): I left it blank
Native client: No
b) At my subscription level (not tenant) Azure portal, the published app settings:
app URL: https://webappname.azurewebsites.net
Configuration->Application settings: shows WEBSITE_NODE_DEFAULT_VERSION and I've added ASPNETCORE_ENVIRONMENT with value "Production".
At the project's appsettings.json, settings are:
"Instance": "https://tenantName.b2clogin.com",
"ClientId": "XXXXXX",
"ClientSecret": "XXXXX",
"Domain": "tenantName.onmicrosoft.com",
"SignedOutCallbackPath": "/signout/B2C_1_mysigninoutpolicy",
"SignUpSignInPolicyId": "B2C_1_mysigninoutpolicy",
"ResetPasswordPolicyId": "B2C_1_myresetpolicy",
"EditProfilePolicyId": "B2C_1_myeditprofilepolicy", // Optional profile editing policy
"CallbackPath": "/signin/B2C_1_mysigninoutpolicy"
The example does't use "Tenant" so I left it out?
I tried uncommenting the example's Callbackpath but same error:
//"CallbackPath": "/signin/B2C_1_sign_up_in" // defaults to /signin-oidc
I restarted the web app and waited a couple of minutes each time I've tested. I browse to test at https://webappname.azurewebsites.net
Thank you for your help
The redirect URI in the application registration must match the callback path in the application configuration.
In the above question, the redirect URI is set to /signin-oidc but the callback path is set to /signin/B2C_1_mysigninoutpolicy, which results in the redirect_uri_mismatch error response.
I have an asp.net core web application hosted in azure as an app service. I've configured the application to use OpenId Connect with Azure AD as the authority. The authentication happens within my application (I am not configuring the app service itself to handle the authentication).
Everything works fine when I hit the app service directly (or even if I use a custom domain name).
I've enabled the CDN service within the app service. Once the initial propagation finished, I open a browser and navigate to the CDN address ([name].azureedge.net).
I get a redirect to Azure AD, but once I finish the authentication process, I get an error.
It looks like when the redirect to Azure AD came back from the CDN, the app service's URL was set as the return_url. So when Azure AD redirected me, I was no longer hitting the CDN. When the redirect to Azure AD happens, there's a cookie placed in my browser; I suspect my site is looking for that cookie, but the browser didn't send it because it was set by a different domain.
I've tried configuring the CallbackPath in the OpenIdConnectOptions to the full URL (schema, host, domain, etc), but when my application initializes, and error is thrown saying that the path must start with a '/' (presumably it's expecting a path from the root of the domain in the request).
Hopefully someone else has come across this problem and can tell me what I'm doing wrong.
Per request, here's my OIDC configuration:
var openIdOptions = new OpenIdConnectOptions
{
ClientId = adSettings.ClientId,
ClientSecret = adSettings.ClientSecret,
Authority = adSettings.Authority,
CallbackPath = adSettings.CallbackPath,
ResponseType = OpenIdConnectResponseType.CodeIdToken,
Events = new OpenIdConnectEvents { OnTicketReceived = AddApplicationRolesToUserClaimsAsync, OnAuthorizationCodeReceived = RedeemCodeAsync }
};
foreach (var scope in adSettings.Scopes.Concat(settings.MicrosoftGraph.Scopes))
openIdOptions.Scope.Add(scope);
application.UseOpenIdConnectAuthentication(openIdOptions);
adSettings is a POCO that is hydrated from the following appsettings.json:
"AzureAd": {
"AADInstance": "https://login.microsoftonline.com/",
"ClientSecret": "REDACTED",
"CallbackPath": "/signin-oidc",
"ClientId": "REDACTED",
"TenantId": "REDACTED",
"Scopes": [
"openid",
"profile",
"offline_access"
]
}
adSettings.Authority is defined in the POCO as:
public string Authority => $"{AADInstance}{TenantId}/v2.0";
After digging around a bit, I found the answer.
The OpenIdConnectOptions.Events property allows you to hook into various events that happen throughout the lifecycle of authentication. One callback is called OnRedirectToIdentityProvider. It provides a RedirectContext. On that object you can read/write to a property called ProtocolMessage.RedirectUri. That property allows you to specify a full URL which is used as the return_url when the user is forwarded to AAD.
It's worth noting that I'm using the Microsoft.AspNetCore.Authorization.OpenIdConnect packge from Nuget. There are other packages available that provide similar functionality that do allow you to set a full URL in the options object.