OpenIddict As A SAML Service Provider

OpenIddict provides it's own Client side OIDC implementation to use over the standard .NET implementation. External authentication providers can be added using the AddClient extension method on the OpenIddictClientBuilder.

services.AddOpenIddict()
    .AddCore(options => {})
    .AddClient(options =>
    {
        // Note: this sample uses the authorization code and refresh token
        // flows, but you can enable the other flows if necessary.
        options.AllowAuthorizationCodeFlow()
                .AllowRefreshTokenFlow();

        // Register the signing and encryption credentials used to protect
        // sensitive data like the state tokens produced by OpenIddict.
        options.AddDevelopmentEncryptionCertificate()
                .AddDevelopmentSigningCertificate();

        // Register the ASP.NET Core host and configure the ASP.NET Core-specific options.
        options.UseAspNetCore()
                .EnableStatusCodePagesIntegration()
                .EnableRedirectionEndpointPassthrough()
                .EnablePostLogoutRedirectionEndpointPassthrough();

        // Register the System.Net.Http integration and use the identity of the current
        // assembly as a more specific user agent, which can be useful when dealing with
        // providers that use the user agent as a way to throttle requests (e.g Reddit).
        options.UseSystemNetHttp()
                .SetProductInformation(typeof(Startup).Assembly);

        // Add a client registration matching the client application definition in the server project.
        options.AddRegistration(new OpenIddictClientRegistration
        {
            Issuer = new Uri("https://localhost:44395/", UriKind.Absolute),
            ProviderName = "Local",

            ClientId = "mvc",
            ClientSecret = "901564A5-E7FE-42CB-B10D-61EF6A8F3654",
            Scopes = { Scopes.Email, Scopes.Profile, Scopes.OfflineAccess, "demo_api" },

            RedirectUri = new Uri("callback/login/local", UriKind.Relative),
            PostLogoutRedirectUri = new Uri("callback/logout/local", UriKind.Relative)
        });
    })

When a Challenge is called, either by returning a ChallengeResult from a controller or via the HttpContext Challenge extension method, the OpenIddict client middleware will pick up the request and use the configured providers.

if (string.Equals(provider, "Local+GitHub", StringComparison.Ordinal))
{
    var properties = new AuthenticationProperties(new Dictionary<string, string>
    {
        // Note: when only one client is registered in the client options,
        // specifying the issuer URI or the provider name is not required.
        [OpenIddictClientAspNetCoreConstants.Properties.ProviderName] = "Local"
    })
    {
        // Only allow local return URLs to prevent open redirect attacks.
        RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/",

        Parameters =
        {
            [Parameters.IdentityProvider] = "GitHub"
        }
    };

    // Ask the OpenIddict client middleware to redirect the user agent to the identity provider.
    return Challenge(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
}

else
{
    var properties = new AuthenticationProperties(new Dictionary<string, string>
    {
        // Note: when only one client is registered in the client options,
        // specifying the issuer URI or the provider name is not required.
        [OpenIddictClientAspNetCoreConstants.Properties.ProviderName] = provider
    })
    {
        // Only allow local return URLs to prevent open redirect attacks.
        RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/"
    };

    // Ask the OpenIddict client middleware to redirect the user agent to the identity provider.
    return Challenge(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
}

The Rock Solid Knowledge SAML component does not currently support this method of configuring external SAML providers/ServiceProviders. SAML ServiceProviders should be configured in the same way as a standalone SAML ServiceProvider and accessed by passing the correct authentication scheme the to challenge method. For more information on configuring the Rock Solid Knowledge SAML component as a ServiceProvider, see our Acting As A ServiceProvider quickstart

Previous Next