Authentication.WsFederation breaks with on-premise AD FS use
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
Using Authentication.WsFederation for authentication results in error regardless of new UseSecurityTokenHandlers setting.
`options.UseSecurityTokenHandlers = true;`
SecurityTokenInvalidIssuerException: IDX10204: Unable to validate issuer. validationParameters.ValidIssuer is null or whitespace AND validationParameters.ValidIssuers is null or empty.
Expected: behavior prior to change introduced with issue 49469.
`options.UseSecurityTokenHandlers = false;`
XmlReadException: IDX30011: Unable to read XML. Expecting XmlReader to be at ns.element: 'urn:oasis:names:tc:SAML:2.0:assertion.Assertion', found: 'urn:oasis:names:tc:SAML:1.0:assertion.Assertion'.
Expected: to be able to handle SAML 1.0 assertion emitted by WsFed server.
### Expected Behavior
options.UseSecurityTokenHandlers = true;
Expected: behavior prior to change introduced with issue 49469.
options.UseSecurityTokenHandlers = false;
Expected: to be able to handle SAML 1.0 assertion emitted by WsFed server.
### Steps To Reproduce
Repro project: https://github.com/csowa/aspdotnetcore-auth-sample
Demonstrates WS-Federation issue with change introduced for https://github.com/dotnet/aspnetcore/issues/49469
Based on example at https://learn.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation?view=aspnetcore-8.0#use-ws-federation-without-aspnet-core-identity
Build and run. Home page uses [Authorize] attribute, authentication begins when loading.
Dependency: ADFS server required. Server version tested: 10.0.17763.4644
### Exceptions (if any)
`options.UseSecurityTokenHandlers = true;`
SecurityTokenInvalidIssuerException: IDX10204: Unable to validate issuer. validationParameters.ValidIssuer is null or whitespace AND validationParameters.ValidIssuers is null or empty.
`options.UseSecurityTokenHandlers = false;`
XmlReadException: IDX30011: Unable to read XML. Expecting XmlReader to be at ns.element: 'urn:oasis:names:tc:SAML:2.0:assertion.Assertion', found: 'urn:oasis:names:tc:SAML:1.0:assertion.Assertion'.
### .NET Version
8.0.100
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.