My ultimate goal is to add SSO (WS-Fed) to an existent Web Forms application (let’s call it OrigApp).
I already have my app (SP)’s relying party trust ready.
My strategy is first to create an off-the-shelf Web Forms app (let’s call it NewApp), and then I will add all appropriate code from OrigApp.
I have already created the Web Forms NewApp (.NET Framework 4.7.2) with the appropriate IdP and my app (SP) urls.
I have tested it and SSO works just fine.
Before I add the code from OrigApp, i am inspecting the code in NewApp, I noticed the following, and I have some questions (listed at the end of the things noticed):
-
web.config now has a whole bunch of references to assemblies (Microsoft.IdentityModel.Tokens, Microsoft.IdentityModel.Tokens.Saml, Microsoft.IdentityModel.Protocols.OpenIdConnect, Microsoft.IdentityModel.Protocols, etc) to support SSO. This makes sense.
-
Global.asax.cs has this on Application_Start():
void Application_Start(object sender, EventArgs e)
{
// Code that runs on application startup
RouteConfig.RegisterRoutes(RouteTable.Routes);
BundleConfig.RegisterBundles(BundleTable.Bundles);
}
- There is now a Startup.cs
public partial class Startup
{
public void Configuration(IAppBuilder app)
{
ConfigureAuth(app);
}
}
ConfigureAuth() is in StartupAuth.cs :
public partial class Startup
{
private static string realm = ConfigurationManager.AppSettings["ida:Wtrealm"];
private static string adfsMetadata = ConfigurationManager.AppSettings["ida:ADFSMetadata"];
public void ConfigureAuth(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions
{
Wtrealm = realm,
MetadataAddress = adfsMetadata
});
// This makes any middleware defined above this line run before the Authorization rule is applied in web.config
app.UseStageMarker(PipelineStage.Authenticate);
}
}
As I said before, I have tested NewApp and SSO works.
My question is, where is the SSO config being called?
As far as I know, ASP.NET will first Application_Start() in Global.asax.cs,
which, as I shown above, I don’t see that any code from the Startup.cs is called from Application_Start() in Global.asax.cs.
I read that with .NET 5 Startup.cs is used in a similar way than Global.asax.cs
Is .Net Framework 4.7.2 considered .NET 5? or is Startup.cs being called by the .Net Framework in 4.7.2 already?
If so, does it call Application_Start() from Global.asax.cs first, and then which method in Startup.cs? Configuration?
public partial class Startup
{
public void Configuration(IAppBuilder app)
{
ConfigureAuth(app);
}
}
So in summary, I need to understand where exactly is the code that handles the SSO called?
I also checked Default.aspx.cs and it is empty.
2
Answers
Tm Son, Here is the web.config file created by VS:
Also, I see there is a packages.config file with these contents:
Could you specify the packages name and exact verions that you have installed? From what I see, I suspect that you might have installed wrong packages that only support ASP.NET MVC (That’s why Startup.cs was created).This Startup.cs is heavily related to MVC and nothing to do with Web Forms. So if the extensions that you trying to use only support registering in Startup.cs instead of Global.asax. I don’t think it would work for ASP.NET Web Forms.
(Updated)
From the web.config that you’ve sent, I guess you are trying to use OWIN/ASP.NET Identify for authentication. Unfortunately ASP.NET Web Forms uses classic ASP.NET authorization and there is no explicity way to use OWIN authentication as middleware. But I think this article describes how to use OWIN in an ASP.NET Web Forms project. Please take note of the voted answer on how to set it up to use OWIN. I hope that helped.