ADFS Authentication Issue in .Net 8

Hi @Vijayan, Neethu,

You are missing app.UseAuthentication();, please add it like below for testing.

app.UseHttpsRedirection();

app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllerRoute(

    name: "default",

    pattern: "{controller=Home}/{action=Index}/{id?}");

app.Run();

Best Regards

Jason

Hi @Vijayan, Neethu,

Please try the suggestion above and let me know the test result, thanks.

Best Regards

Jason

Thank you Jason.

I've tested the updated code, but I encountered an error on my localhost: "Error details: MSIS7007: The requested relying party trust 'https://testdev.com/' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. Contact your administrator for details." When I deployed the same code to my IIS hosted site, it redirected to a URL https://testdev.com/signin-wsfed. Do I need to explicitly set the Wreply url to redirect to my Home page? I am not sure whether the authentication is successful or not.

Hi @Vijayan, Neethu,

app.UseAuthentication(); is needed, and now MSIS7007 error means you not configured the SAML relying party on ADFS or that you have but have not configured this endpoint.

Please contact you IT team. Thanks for your patience.

Best Regards

Jason

Thank you so mush for your support Jason

Thank you so much for your support Jason

Hi @Vijayan, Neethu,

It's my pleasure, please let me know if the suggestion is useful to you.

Best Regards

Jason

That was really helpful, Jason.

The authentication request works now. But the request seems failing.

I have tried logging in to my hosted website for which the relying party is already set up in ADFS. I can see that it's hitting the OnSecurityTokenReceived event. However, I'm encountering the error 'Microsoft.IdentityModel.Tokens.SecurityTokenException: No token validator or token handler was found for the given token'. I'm attaching the log file for your reference. sqs20240508.txt

Thanks

Neethu

Hi @Vijayan, Neethu,

From the error message, please try to add TokenValidationParameters like below.

.AddWsFederation(options =>
{
    options.MetadataAddress = "https://example.com/FederationMetadata/2007-06/FederationMetadata.xml"; 
    options.Wtrealm = "urn:DevDotNet"; 
    options.Wreply = "https://testdev.com/";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidIssuer = "https://expected-issuer.com", // change to expected issuer
 
        ValidateAudience = true,
        ValidAudience = "urn:DevDotNet", // make sure it match with Wtrealm or you want
        ValidateLifetime = true,
        ClockSkew = TimeSpan.FromMinutes(5) 
    };
   ...
});

And you also need to check the jwt token(online tool https://jwt.io), is it expected?

Best Regards

Jason

Thank you, Jason.

I've tried the code provided above, but I'm still encountering the same error. I am attaching my program.cs and the error log for your reference(Program_v2.txt , sqs20240508.txt). I also attempted the solution mentioned in the last comment of this Stack Overflow thread (https://stackoverflow.com/questions/50743008/asp-net-microsoft-identitymodel-tokens-securitytokenexception-no-validator-foun), but it didn't resolve the issue.

Thanks

Neethu

Hi @Vijayan, Neethu,

The Stackoverflow link you shared is useful, have you checked the token by using CustomSAMLTokenValidation method in the link.

Best Regards

Jason

Hi Jason,

I'm trying to implement custom validation as per the link, but I'm encountering the error "IDX10500: Signature validation failed. No security keys were provided to validate the signature." Setting ValidateIssuerSigningKey = false bypasses issuer validation, but it still requires the signing key.

To validate the SAML signature, do I need to obtain certificate information from the IT team? If so, I'll request it accordingly. Is there any option to bypass this?

IssuerSigningKeys = new List<SecurityKey>
{
    new X509SecurityKey(new X509Certificate2("path_to_certificate.pfx", "certificate_password")),
},