User280723817 posted
Hi Chris, Thanks for the response. That part is all good for me. To explain my scenario better, I created a sample app:
1. In VS2015 I created a new ASP.NET Web Application (4.5.2) and chose MVC with Web API
2. For Authentication, I picked Work And School Accounts and used On-Premises option with ADFS metadata and App ID.
3. In Startup.Auth it already had app.UseWsFederationAuthentication and I added app.UseActiveDirectoryFederationServicesBearerAuthentication() for the API. So my code looks like this:
public partial class Startup
{
private static string realm = ConfigurationManager.AppSettings["ida:Wtrealm"];
private static string adfsMetadata = ConfigurationManager.AppSettings["ida:ADFSMetadata"];
public void ConfigureAuth(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions
{
Wtrealm = realm,
MetadataAddress = adfsMetadata
});
var options = new ActiveDirectoryFederationServicesBearerAuthenticationOptions
{
MetadataEndpoint = adfsMetadata,
TokenValidationParameters = new TokenValidationParameters()
{
ValidAudience = realm
},
};
app.UseActiveDirectoryFederationServicesBearerAuthentication(options);
}
}
4. My MVC HomeController has MVC AuthorizeAttribute
[Authorize]
public class HomeController : Controller
{
public ActionResult Index()
{
return View();
}
}
5. Then I added an API Controller and added protected it with the Http Authorize attribute.
[Authorize]
public class ValuesController : ApiController
{
// GET: api/Values
public IEnumerable<string> Get()
{
return new string[] { "value1", "value2" };
}
}
6. I run my MVC home page and I get authenticated correctly by ADFS and that's good.
7. Then I generate a Bearer token and call the API and I can get values back. That's also good. I get ["value1","value2"] back.
HttpClient client = new HttpClient();
HttpRequestMessage request =
new HttpRequestMessage(HttpMethod.Get, "https://localhost:44329/api/values");
request.Headers.TryAddWithoutValidation("Authorization", access.Token);
HttpResponseMessage response = client.SendAsync(request).Result;
string responseString = response.Content.ReadAsStringAsync().Result;
Console.WriteLine(responseString);
8. Now I add a role to the API Authorize attribute for a scenario where caller does not have access:
[Authorize(Roles = "user-does-not-have-this-role")]
public class ValuesController : ApiController
{
// GET: api/Values
public IEnumerable<string> Get()
{
return new string[] { "value1", "value2" };
}
}
9. This is where the issue is. Now the client code (Step #7) is returning an HTML content back which seems like an error page from the ADFS saying you don't have JavaScript. The issue is that when the Web API threw a 401, the MVC part of the OWIN
Auth logic kicked in and redirected the call to ADFS instead of returning a 401 like it should.
10. Now if I comment out the 'app.UseWsFederationAuthentication' part, I correctly get the 401 Unauthorized message for the API client (step 7)
{"Message":"Authorization has been denied for this request."}
I want to use both authentication options but I want to make it so that the passive authentication for MVC does not mess with the API 401s.
How can I do that?
