How to get a SAML Protocol Response from ADFS using C#

Posted On April 21, 2014

ADFS (Active Directory Federation Services) is a fancy name for Windows Identity Foundation Server. ADFS supports SAML protocol, however its client, Windows Identity Foundation (WIF), does not. As most of the problems of acquiring a token can be resolved with either WS-Federation and WS-Trust, you may use WIF for your federation needs since WIF supports SAML-Token (please notice SAML-Protocol is not the same as SAML-Token).

Lately I have received requests from partners and customers to acquire a SAML Protocol Response which would require SAML-Protocol to request. WIF unfortunately cannot be used to make a SAML-Protocol request and there is no out-of-the-box way of doing that. There are some paid NuGets implementing SAML-Protocol in C#, but none is free. I put together a workaround to request a SAML-Protocol response from ADFS in C# using HttpClient (from System.Net.Http library). System.Net.Http.HttpClient class comes with .NET 4.5 and 4.5.1 and can be added via NuGet to .NET 4.0. The idea is to leverage ADFS Idp Initiated Login page and follow the redirects to extract the SAML Response that happens during the process of logging in to a SAML-Protocol endpoint.

Requirements

You have to create a SAML-Protocol Assertion Endpoint with POST binding in your reliant party configuration. This endpoint can co-exist with a Federation endpoint.

image

Code

I put together two samples. One that shows step-by-step using a Windows Forms application how to acquire a SAML Response (you can download it here):

image

Windows Forms Snippet
  1. using System;
  2. using System.Collections.Generic;
  3. using System.ComponentModel;
  4. using System.Data;
  5. using System.Drawing;
  6. using System.Linq;
  7. using System.Net.Http;
  8. using System.Text;
  9. using System.Threading.Tasks;
  10. using System.Windows.Forms;
  11. using System.Xml;
  12. using System.Text.RegularExpressions;
  13. using System.Web;
  14. using System.IO;
  15. using System.IO.Compression;
  17. //The code samples are provided AS IS without warranty of any kind.
  18. // Microsoft disclaims all implied warranties including, without limitation,
  19. // any implied warranties of merchantability or of fitness for a particular purpose.
  21. /*
  23. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you.
  24. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts
  25. be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption,
  26. loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts
  27. or documentation, even if Microsoft has been advised of the possibility of such damages.
  29. */
  31. namespace GetSaml
  32. {
  33.     public partial class Form1 : Form
  34.     {
  35.         public Form1()
  36.         {
  37.             InitializeComponent();
  38.         }
  40.         private string getUrl = null;
  41.         private string GetUrl
  42.         {
  43.             get
  44.             {
  45.                 if (!String.IsNullOrEmpty(getUrl))
  46.                     return getUrl;
  47.                 StringBuilder domain = new StringBuilder();
  48.                 domain.Append(Environment.GetEnvironmentVariable(“USERDNSDOMAIN”));
  49.                 if (domain.Length > 0)
  50.                 {
  51.                     domain.Clear();
  52.                     domain.Append(Environment.UserDomainName);
  53.                 }
  54.                 
  55.                 //return String.Format(“https://{0}.{1}.lab/adfs/ls/MyIdpInitiatedSignOn.aspx?loginToRp=https://mysyte.com”, Environment.MachineName.ToLower(), Environment.UserDomainName.ToLower());
  56.                 return String.Format(“https://{0}.{1}.lab/adfs/ls/IdpInitiatedSignOn.aspx”, Environment.MachineName.ToLower(), Environment.UserDomainName.ToLower());
  57.             }
  58.         }
  59.         private void Form1_Load(object sender, EventArgs e)
  60.         {
  61.             textBox1.Text = GetUrl;
  62.         }
  64.         protected List<KeyValuePair<string, string>> forms;
  66.         private HttpClient client = null;
  67.         private HttpClientHandler handler;
  69.         private HttpClient Client
  70.         {
  71.             get
  72.             {
  73.                 if (client == null)
  74.                 {
  75.                     handler = new HttpClientHandler();
  76.                     handler.UseDefaultCredentials = true;
  77.                     handler.AllowAutoRedirect = false;
  78.                     handler.CookieContainer = new System.Net.CookieContainer();
  79.                     handler.UseCookies = true;
  80.                     client = new HttpClient(handler);
  81.                     client.MaxResponseContentBufferSize = 256000;
  82.                     client.DefaultRequestHeaders.Add(“User-Agent”, “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)”);
  83.                     client.DefaultRequestHeaders.Add(“Connection”, “Keep-Alive”);
  84.                     client.DefaultRequestHeaders.ExpectContinue = false;
  87.                 }
  88.                 return client;
  89.             }
  90.         }
  92.         private async void button1_Click(object sender, EventArgs e)
  93.         {
  95.             string url = String.Format(“{0}?loginToRp={1}”, textBox1.Text, HttpUtility.UrlEncode(comboBox1.SelectedItem.ToString()));
  96.             // Limit the max buffer size for the response so we don’t get overwhelmed
  97.             HttpResponseMessage result;
  98.             textBox3.Text=“============== Start ===============”;
  99.             var nl = Environment.NewLine;
  101.        
  103.             string text;
  104.             do
  105.             {
  108.                 textBox3.AppendText(String.Format(“{1}********** GET {0}{1}”, url, Environment.NewLine));
  109.                 result = await Client.GetAsync(url);
  112.                 text = await result.Content.ReadAsStringAsync();
  113.                 IEnumerable<string> values;
  114.                 if(result.Headers.TryGetValues(“location”, out values))
  115.                 {
  116.                     foreach(string s in values)
  117.                     {
  119.                         if (s.StartsWith(“/”))
  120.                         {
  121.                             url = url.Substring(0, url.IndexOf(“/adfs/ls”)) + s;
  122.                         }
  123.                         else
  124.                             url = s;
  125.                     }
  127.                 } else
  128.                 {
  129.                     url = “”;
  130.                 }
  131.                 textBox3.AppendText(String.Format(“{0}[Headers]{0}”, Environment.NewLine));
  132.                 foreach(var pair in result.Headers)
  133.                 {
  134.                     string key = pair.Key;
  135.                     foreach(var val in pair.Value)
  136.                         textBox3.AppendText(String.Format(” {0}={1}{2}”, key, val, Environment.NewLine));
  137.                 }
  139.                 textBox3.AppendText(text);
  140.             } while (!String.IsNullOrEmpty(url));
  143.             Regex reg = new Regex(“SAMLResponse\\W+value\\=\\\”([^\\\”]+)\\\””);
  144.             MatchCollection matches = reg.Matches(text);
  145.             string last = null;
  146.             foreach (Match m in matches)
  147.             {
  148.                 last = m.Groups[1].Value;
  149.                 textBox3.AppendText(String.Format(” {1}{1}{1}SAMLResponse={0}{1}”, last, Environment.NewLine));
  150.             }
  151.             if(last != null)
  152.             {
  154.                 byte[] decoded = Convert.FromBase64String(last);
  156.                 string deflated = Encoding.UTF8.GetString(decoded);
  157.                 XmlDocument doc = new XmlDocument();
  158.                 StringBuilder sb = new StringBuilder();
  159.                 doc.LoadXml(deflated);
  161.                 using(StringWriter sw = new StringWriter(sb))
  162.                 {
  163.                     using (XmlTextWriter tw = new XmlTextWriter(sw) { Formatting = Formatting.Indented })
  164.                     {
  165.                         doc.WriteTo(tw);
  166.                     }
  167.                 }
  168.                 textBox3.AppendText(String.Format(” {1}{1}{1}XML Formated:{1}{0}{1}”, sb.ToString(), Environment.NewLine));
  169.                 
  170.             }
  171.         }
  175.         private void DysplayError(Exception ex)
  176.         {
  177.             MessageBox.Show(String.Format(“Error: {0}{1}Stack:{1}{2}”, ex.Message, Environment.NewLine, ex.StackTrace));
  178.         }
  180.         private async void button2_Click(object sender, EventArgs e)
  181.         {
  182.             try
  183.             {
  184.                 var response = await Client.GetAsync(textBox1.Text);
  185.                 response.EnsureSuccessStatusCode();
  186.                 comboBox1.Items.Clear();
  187.                 string text = await response.Content.ReadAsStringAsync();
  188.                 Regex reg = new Regex(“option\\W+value\\=\\\”([^\\\”]+)\\\””);
  189.                 MatchCollection matches = reg.Matches(text);
  190.                 foreach(Match m in matches)
  191.                 {
  192.                     comboBox1.Items.Add(m.Groups[1].Value);
  193.                 }
  194.                 if (matches.Count == 0)
  195.                 {
  196.                     MessageBox.Show(“No Reliant Party found”);
  197.                     button1.Enabled = false;
  198.                 } else
  199.                 {
  200.                     button1.Enabled = true;
  201.                     comboBox1.SelectedIndex = 0;
  202.                 }
  204.             } catch(Exception ex)
  205.             {
  206.                 DysplayError(ex);
  207.                 return;
  208.             }
  209.         }
  212.     }
  213. }

I also organized the code in a class library that can be used in any C# application. You can download the code and test application here.

Class to get SAML Response
  1. using System;
  2. using System.Collections.Generic;
  3. using System.Text;
  4. using System.Threading.Tasks;
  5. using System.Net.Http;
  6. using System.Text.RegularExpressions;
  7. using System.Web;
  8. using System.Xml;
  9. using System.IO;
  11. //The code samples are provided AS IS without warranty of any kind.
  12. // Microsoft disclaims all implied warranties including, without limitation,
  13. // any implied warranties of merchantability or of fitness for a particular purpose.
  15. /*
  17. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you.
  18. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts
  19. be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption,
  20. loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts
  21. or documentation, even if Microsoft has been advised of the possibility of such damages.
  23. */
  25. namespace Microsoft.Samples.AdfsSaml
  26. {
  27.     /// <summary>
  28.     /// Class to get a SAML response from ADFS.
  29.     /// it requires that the SAML endpoint with POST binding is configured in ADFS
  30.     /// </summary>
  31.     public class SamlResponse
  32.     {
  34.         /// <summary>
  35.         /// If true, ADFS url will not be validated
  36.         /// </summary>
  37.         public bool EnableRawUrl
  38.         {
  39.             get;
  40.             set;
  41.         }
  43.         private Uri serverAddress = null;
  44.         private HttpClient client = null;
  45.         private HttpClientHandler handler;
  47.         private HttpClient Client
  48.         {
  49.             get
  50.             {
  51.                 if (client == null)
  52.                 {
  53.                     handler = new HttpClientHandler();
  54.                     handler.UseDefaultCredentials = true;
  55.                     handler.AllowAutoRedirect = false;
  56.                     handler.CookieContainer = new System.Net.CookieContainer();
  57.                     handler.UseCookies = true;
  58.                     client = new HttpClient(handler);
  59.                     client.MaxResponseContentBufferSize = 256000;
  60.                     client.DefaultRequestHeaders.Add(“User-Agent”, “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)”);
  61.                     client.DefaultRequestHeaders.Add(“Connection”, “Keep-Alive”);
  62.                     client.DefaultRequestHeaders.ExpectContinue = false;
  63.                 }
  64.                 return client;
  65.             }
  66.         }
  68.         /// <summary>
  69.         /// Url of ADFS server (e.g. https://adfs.contoso.com)
  70.         /// </summary>
  71.         public Uri ServerAddress
  72.         {
  73.             get
  74.             {
  75.                 return serverAddress;
  76.             }
  77.             set
  78.             {
  79.                 if(EnableRawUrl)
  80.                 {
  81.                     serverAddress = value;
  82.                     return;
  83.                 }
  84.                 string host = value.Host;
  85.                 string scheme = value.Scheme;
  86.                 if(scheme != “https”)
  87.                 {
  88.                     throw new ArgumentException(“ADFS rquires scheme https. Set EnableRawUrl to true to override it”, “ServerAddress”);
  89.                 }
  90.                 serverAddress = new Uri(String.Format(“https://{0}//adfs/ls/IdpInitiatedSignOn.aspx”, host));
  91.             }
  92.         }
  93.         /// <summary>
  94.         /// Initialize the class
  95.         /// </summary>
  96.         public SamlResponse()
  97.         {
  99.         }
  101.         /// <summary>
  102.         /// Initialize the class
  103.         /// </summary>
  104.         /// <param name=”Url”>Urn of reliant party as defined in ADFS. Ise GetReliantPArtyCollection to get the list</param>
  105.         /// <param name=”IsRawUrl”>If true, ADFS url will not be validated</param>
  106.         public SamlResponse(Uri Url, bool IsRawUrl = false)
  107.         {
  108.             EnableRawUrl = IsRawUrl;
  109.             ServerAddress = Url;
  110.         }
  112.         private async Task<string[]> GetReliantPartyCollectionInternal()
  113.         {
  114.             if (serverAddress == null)
  115.             {
  116.                 throw new NullReferenceException(“ServerAddress was not set”);
  117.             }
  119.             var response = await Client.GetAsync(serverAddress);
  120.             response.EnsureSuccessStatusCode();
  121.             string text = await response.Content.ReadAsStringAsync();
  122.             Regex reg = new Regex(“option\\W+value\\=\\\”([^\\\”]+)\\\””);
  123.             MatchCollection matches = reg.Matches(text);
  124.             if(matches.Count == 0)
  125.             {
  126.                 return null;
  127.             }
  128.             string[] rps = new string[matches.Count];
  129.             uint i = 0;
  130.             foreach (Match m in matches)
  131.             {
  132.                 rps[i++]=m.Groups[1].Value;
  133.             }
  134.             return rps;
  135.         }
  138.         /// <summary>
  139.         /// Get the list of Reliant Parties with SAML endpoint with binding POST in ADFS
  140.         /// </summary>
  141.         public string[] GetReliantPartyCollection()
  142.         {
  143.             return GetReliantPartyCollectionInternal().Result;
  144.         }
  146.         /// <summary>
  147.         /// Retrieve the SAML Response from ADFS for ReliantPartyUrn
  148.         /// </summary>
  149.         /// <param name=”ReliantPartyUrn”>Urn of reliant party as defined in ADFS. Ise GetReliantPArtyCollection to get the list</param>
  150.         public string RequestSamlResponse(string ReliantPartyUrn)
  151.         {
  152.             if(serverAddress == null)
  153.             {
  154.                 throw new NullReferenceException(“ServerAddress was not set”);
  155.             }
  156.             if(String.IsNullOrEmpty(ReliantPartyUrn) && !EnableRawUrl)
  157.             {
  158.                 throw new ArgumentException(“Reliant Party Urn cannot be empty if EnableRawUrl is not true”);
  159.             }
  162.             return SamlResponseInternal(ReliantPartyUrn).Result;
  163.             
  164.         }
  166.         private async Task<string> SamlResponseInternal(string ReliantPartyUrn)
  167.         {
  169.             StringBuilder url = new StringBuilder(String.Format(“{0}?loginToRp={1}”, serverAddress, HttpUtility.UrlEncode(ReliantPartyUrn)));
  170.             HttpResponseMessage result;
  171.             
  172.             do
  173.             {
  174.                 result = await Client.GetAsync(url.ToString());
  176.                 string text = await result.Content.ReadAsStringAsync();
  177.                 IEnumerable<string> values;
  178.                 if (result.Headers.TryGetValues(“location”, out values))
  179.                 {
  180.                     foreach (string s in values)
  181.                     {
  182.                         if (s.StartsWith(“/”))
  183.                         {
  184.                             string newUrl = url.ToString().Substring(0, url.ToString().IndexOf(“/adfs/ls”));
  185.                             url.Clear();
  186.                             url.Append(newUrl);
  187.                             url.Append(s);
  188.                         }
  189.                         else
  190.                         {
  191.                             url.Clear();
  192.                             url.Append(s);
  193.                         }
  194.                     }
  196.                 }
  197.                 else
  198.                 {
  199.                     url.Clear();
  200.                 }
  201.                 if (url.Length == 0)
  202.                 {
  203.                     Regex reg = new Regex(“SAMLResponse\\W+value\\=\\\”([^\\\”]+)\\\””);
  204.                     MatchCollection matches = reg.Matches(text);
  205.                     foreach (Match m in matches)
  206.                     {
  207.                         return m.Groups[1].Value;
  208.                     }
  209.                 }
  211.             } while (url.Length > 0);
  212.             throw new InvalidOperationException(“Unable to get a SAMLP response from ADFS”);
  213.         }
  215.         public static string SamlToXmlString(string EncodedResponse)
  216.         {
  217.             byte[] decoded = Convert.FromBase64String(EncodedResponse);
  219.             string deflated = Encoding.UTF8.GetString(decoded);
  220.             XmlDocument doc = new XmlDocument();
  221.             StringBuilder sb = new StringBuilder();
  222.             doc.LoadXml(deflated);
  224.             using (StringWriter sw = new StringWriter(sb))
  225.             {
  226.                 using (XmlTextWriter tw = new XmlTextWriter(sw) { Formatting = Formatting.Indented })
  227.                 {
  228.                     doc.WriteTo(tw);
  229.                 }
  230.             }
  231.             return sb.ToString();
  233.         }
  234.     }
  235. }
30 Comments
  1. ramon castillo

    Most excellent utility.  Thank you.

  2. Todd

    I have attempted to use the Form to pull a SAMLResponse from the AWS Relying Party trust off of my ADFS server however it doesn't show the SAMLResponse output anywhere. Thoughts?

  3. Rodney Viana

    Hi Todd,

    I never tested this scenario. Do you have problems if AWS is not the RP? What is the output you get in the text box?

  4. Todd

    Yes I have ran this against the 2 other sites in the Target Name drop down list. None show the SAMLResponse.

    It's a lot of text including SAMLRequest and  Page information. Just doesn't include your SAMLResponse shown above. I simply downloaded the Form code, and ran the .exe and put in my adfs server name and then chose the AWS site.

  5. Rodney Viana

    Todd,

    Can you show me an output?

  6. Todd

    Do I need to be installing anything before running the GetSaml.exe? I am not a master coder by any means so I was running the form rather than trying to do a C# application.

    Here is the output:

    ============== Start ===============

    ********** GET https://ADFS/adfs/ls/IdpInitiatedSignOn.aspx?loginToRp=urn%3aamazon%3awebservices

    [Headers]

    Pragma=no-cache

    Cache-Control=no-cache

    Date=Mon, 27 Oct 2014 19:40:24 GMT

    Location=https://ADFS/adfs/ls/?SAMLRequest=7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ%2fff%2fz9cZmQBbPbOStrJniGAqsgfP358Hz8iHjfZolw9Ol638%2bWr%2fBet86ZNz55%2b9tHvn%2b09zCf5w3z7PLu3u70%2fvT%2fbzvJ7B9v39w5me7uzbDp9%2bPCj9Cfzuimq5Wcf7Y13PkrPmmadny2bNlu29NHO7v727s723oM3uw8f7e882n84%2fnR356c%2bSp9SL8Uya%2fnNeduumkd377Zt0zbjts5mxfKizafzZVVWF0XejKfV4m42O2%2fuls3dj9KTatnkgL%2bul4%2bqrCmaR8tskTeP2umj18dfPH9EqDyaSqNH62WzyqfFeZHPPkrfLcpl84gHvPntVV211bQqPzp6zEOq5dXNL2VNk9cY0kdHGNLtRkSvXBbTvLnb1uumfXxXujt6TIOcFQDWvGfXj4%2fXsyJfTvNXROO6mOJT9%2bERoGSL7AfV8tFVPjG9P75rG7hfAwB3HUL0R59njv4f&Signature=haV26bjGqbuPcg0sywh3h3pwsbZ3WdPy20r2GTax%2b4Or0qVJ9rZiIi4CQToev83N0Iyah%2bi%2btbowVj8Au7HYau43vlSkz%2foQondUYEnkUNHi8PaExLIXZ8vPCVYCWSu%2bbIEHTQh%2fOiGFNRFL47o7eGfdFoc87rmHcTWrxbJyO9BdiHT%2fVvG6h5LjtD%2fk1YbR0ZcMwnJlIujnaYVJ8mp9kc908vsG4Jp8yyUD8f1R09TXjgEGV9oExOjcOHcZf6KDwfp6vRKGXjhaBAivdIbHzlCUsfSjrJIukuif6ng6FKvvqBd%2bNh%2fMjoYXIiGcQ%2bSyPTKsnc%2fJvHM0RKIhvByBgOf2G2ieTlnU2aPf5Vwnzo1nTUwI7PVvIWRDfI1d727pDBhK%2f%2fXFDe%2b9nK8BF3MOYdqWE650ISwhPQyQP9d75DhOdG%2fd%2fRp4q8ogjyb%2fv4oy02szfH66Ezlx1elXn7WQsKC41FgyMFmhqvqJsn7In7tgmXXkKIFhJN13bOIDIqXnef8uZsDGYWG8topaYgnCtgVa6KQr9fQxiI9ZmeJ1TpuXG1WDXmGcwZ4U3yq2hGFebliAzhqj9ePgVShwrFTctKifjrMugBdDE8gQLaQXXBSJC0F54gfG9jYUksYwxT9RUfOB%2b0NvVq4lhIxc3n0nO%2fN3AShDG2jRjzdQ5KTsO4c%3d&SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256

    Server=Microsoft-IIS/7.5

    X-AspNet-Version=2.0.50727

    X-Powered-By=ASP.NET

  7. Todd

    <html><head></head><body>

    <h2>Object moved to <a href="https://ADFS/adfs/ls/?SAMLRequest=7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ%2fff%2fz9cZmQBbPbOStrJniGAqsgfP358Hz8iHjfZolw9Ol638%2bWr%2fBet86ZNz55%2b9tHvn%2b09zCf5w3z7PLu3u70%2fvT%2fbzvJ7B9v39w5me7uzbDp9%2bPCj9Cfzuimq5Wcf7Y13PkrPmmadny2bNlu29NHO7v727s723oM3uw8f7e882n84%2fnR356c%2bSp9SL8Uya%2fnNeduumkd377Zt0zbjts5mxfKizafzZVVWF0XejKfV4m42O2%2fuls3dj9KTatnkgL%2bul4%2bqrCmaR8tskTeP2umj18dfPH9EqDyaSqNH62WzyqfFeZHPPkrfLcpl84gHvPntVV211bQqPzp6zEOq5dXNL2VNk9cY0kdHGNLtRkSvXBbTvLnb1uumfXxXujt6TIOcFQDWvGfXj4%2fXsyJfTvNXROO6mOJT9%2bERoGSL7AfV8tFVPjG9P75rG7hfAwB3HUL0R59njv4f&Signature=haV26bjGqbuPcg0sywh3h3pwsbZ3WdPy20r2GTax%2b4Or0qVJ9rZiIi4CQToev83N0Iyah%2bi%2btbowVj8Au7HYau43vlSkz%2foQondUYEnkUNHi8PaExLIXZ8vPCVYCWSu%2bbIEHTQh%2fOiGFNRFL47o7eGfdFoc87rmHcTWrxbJyO9BdiHT%2fVvG6h5LjtD%2fk1YbR0ZcMwnJlIujnaYVJ8mp9kc908vsG4Jp8yyUD8f1R09TXjgEGV9oExOjcOHcZf6KDwfp6vRKGXjhaBAivdIbHzlCUsfSjrJIukuif6ng6FKvvqBd%2bNh%2fMjoYXIiGcQ%2bSyPTKsnc%2fJvHM0RKIhvByBgOf2G2ieTlnU2aPf5Vwnzo1nTUwI7PVvIWRDfI1d727pDBhK%2f%2fXFDe%2b9nK8BF3MOYdqWE650ISwhPQyQP9d75DhOdG%2fd%2fRp4q8ogjyb%2fv4oy02szfH66Ezlx1elXn7WQsKC41FgyMFmhqvqJsn7In7tgmXXkKIFhJN13bOIDIqXnef8uZsDGYWG8topaYgnCtgVa6KQr9fQxiI9ZmeJ1TpuXG1WDXmGcwZ4U3yq2hGFebliAzhqj9ePgVShwrFTctKifjrMugBdDE8gQLaQXXBSJC0F54gfG9jYUksYwxT9RUfOB%2b0NvVq4lhIxc3n0nO%2fN3AShDG2jRjzdQ5KTsO4c%3d&SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256">here</a&gt;.</h2>

    </body></html>

    ********** GET https://ADFS/adfs/ls/?SAMLRequest=7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ%2fff%2fz9cZmQBbPbOStrJniGAqsgfP358Hz8iHjfZolw9Ol638%2bWr%2fBet86ZNz55%2b9tHvn%2b09zCf5w3z7PLu3u70%2fvT%2fbzvJ7B9v39w5me7uzbDp9%2bPCj9Cfzuimq5Wcf7Y13PkrPmmadny2bNlu29NHO7v727s723oM3uw8f7e882n84%2fnR356c%2bSp9SL8Uya%2fnNeduumkd377Zt0zbjts5mxfKizafzZVVWF0XejKfV4m42O2%2fuls3dj9KTatnkgL%2bul4%2bqrCmaR8tskTeP2umj18dfPH9EqDyaSqNH62WzyqfFeZHPPkrfLcpl84gHvPntVV211bQqPzp6zEOq5dXNL2VNk9cY0kdHGNLtRkSvXBbTvLnb1uumfXxXujt6TIOcFQDWvGfXj4%2fXsyJfTvNXROO6mOJT9%2bERoGSL7AfV8tFVPjG9P75rG7hfAwB3HUL0R59njv4f&Signature=haV26bjGqbuPcg0sywh3h3pwsbZ3WdPy20r2GTax%2b4Or0qVJ9rZiIi4CQToev83N0Iyah%2bi%2btbowVj8Au7HYau43vlSkz%2foQondUYEnkUNHi8PaExLIXZ8vPCVYCWSu%2bbIEHTQh%2fOiGFNRFL47o7eGfdFoc87rmHcTWrxbJyO9BdiHT%2fVvG6h5LjtD%2fk1YbR0ZcMwnJlIujnaYVJ8mp9kc908vsG4Jp8yyUD8f1R09TXjgEGV9oExOjcOHcZf6KDwfp6vRKGXjhaBAivdIbHzlCUsfSjrJIukuif6ng6FKvvqBd%2bNh%2fMjoYXIiGcQ%2bSyPTKsnc%2fJvHM0RKIhvByBgOf2G2ieTlnU2aPf5Vwnzo1nTUwI7PVvIWRDfI1d727pDBhK%2f%2fXFDe%2b9nK8BF3MOYdqWE650ISwhPQyQP9d75DhOdG%2fd%2fRp4q8ogjyb%2fv4oy02szfH66Ezlx1elXn7WQsKC41FgyMFmhqvqJsn7In7tgmXXkKIFhJN13bOIDIqXnef8uZsDGYWG8topaYgnCtgVa6KQr9fQxiI9ZmeJ1TpuXG1WDXmGcwZ4U3yq2hGFebliAzhqj9ePgVShwrFTctKifjrMugBdDE8gQLaQXXBSJC0F54gfG9jYUksYwxT9RUfOB%2b0NvVq4lhIxc3n0nO%2fN3AShDG2jRjzdQ5KTsO4c%3d&SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256

  8. Todd

    [Headers]

    Pragma=no-cache

    Cache-Control=no-cache

    Date=Mon, 27 Oct 2014 19:40:24 GMT

    Server=Microsoft-IIS/7.5

    X-AspNet-Version=2.0.50727

    X-Powered-By=ASP.NET

    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/…/xhtml1-transitional.dtd"&gt;

    <html xmlns="http://www.w3.org/…/xhtml&quot; dir="ltr">

    <head><meta http-equiv="X-UA-Compatible" content="IE=8" /><link rel="stylesheet" type="text/css" href="MasterPages/StyleSheet.css" /><meta name="robots" content="noindex, nofollow" /></head>

    <body>

       <form name="aspnetForm" method="post" action="/adfs/ls/?SAMLRequest=7b0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ%2fff%2fz9cZmQBbPbOStrJniGAqsgfP358Hz8iHjfZolw9Ol638%2bWr%2fBet86ZNz55%2b9tHvn%2b09zCf5w3z7PLu3u70%2fvT%2fbzvJ7B9v39w5me7uzbDp9%2bPCj9Cfzuimq5Wcf7Y13PkrPmmadny2bNlu29NHO7v727s723oM3uw8f7e882n84%2fnR356c%2bSp9SL8Uya%2fnNeduumkd377Zt0zbjts5mxfKizafzZVVWF0XejKfV4m42O2%2fuls3dj9KTatnkgL%2bul4%2bqrCmaR8tskTeP2umj18dfPH9EqDyaSqNH62WzyqfFeZHPPkrfLcpl84gHvPntVV211bQqPzp6zEOq5dXNL2VNk9cY0kdHGNLtRkSvXBbTvLnb1uumfXxXujt6TIOcFQDWvGfXj4%2fXsyJfTvNXROO6mOJT9%2bERoGSL7AfV8tFVPjG9P75rG7hfAwB3HUL0R59njv4f&Signature=haV26bjGqbuPcg0sywh3h3pwsbZ3WdPy20r2GTax%2b4Or0qVJ9rZiIi4CQToev83N0Iyah%2bi%2btbowVj8Au7HYau43vlSkz%2foQondUYEnkUNHi8PaExLIXZ8vPCVYCWSu%2bbIEHTQh%2fOiGFNRFL47o7eGfdFoc87rmHcTWrxbJyO9BdiHT%2fVvG6h5LjtD%2fk1YbR0ZcMwnJlIujnaYVJ8mp9kc908vsG4Jp8yyUD8f1R09TXjgEGV9oExOjcOHcZf6KDwfp6vRKGXjhaBAivdIbHzlCUsfSjrJIukuif6ng6FKvvqBd%2bNh%2fMjoYXIiGcQ%2bSyPTKsnc%2fJvHM0RKIhvByBgOf2G2ieTlnU2aPf5Vwnzo1nTUwI7PVvIWRDfI1d727pDBhK%2f%2fXFDe%2b9nK8BF3MOYdqWE650ISwhPQyQP9d75DhOdG%2fd%2fRp4q8ogjyb%2fv4oy02szfH66Ezlx1elXn7WQsKC41FgyMFmhqvqJsn7In7tgmXXkKIFhJN13bOIDIqXnef8uZsDGYWG8topaYgnCtgVa6KQr9fQxiI9ZmeJ1TpuXG1WDXmGcwZ4U3yq2hGFebliAzhqj9ePgVShwrFTctKifjrMugBdDE8gQLaQXXBSJC0F54gfG9jYUksYwxT9RUfOB%2b0NvVq4lhIxc3n0nO%2fN3AShDG2jRjzdQ5KTsO4c%3d&SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256" id="aspnetForm">

    <div>

    <input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKMTY2MTc3NjUzM2Rk" />

    </div>

    <div>

  9. Rodney Viana

    Are you calling from the same machine ADFS is installed? If so, it will not work because of the loopback check (which you can disable). Short of it, the SAMLRequest seems to be right.

  10. Todd

    Character limit, I apologize for having to break it up like this.

  11. Todd

    Nope, I am running this from my own machine and targeting the ADFS machine. I was looking to get the SAMLResponse which it just is not giving me in the output.

  12. Todd

    I am running the .exe from my own machined and targeting the ADFS server and AWS site. Weird I am not getting that SAMLResponse I need. I should simply just be able to download your code form .exe and run it right?

  13. Todd

    Calling from my machine and targeting the ADFS server and AWS relying site I configured. Just doesn't have the SAMLResponse I need to run an API command. I should just be able to download and run the getsaml.exe and target this right, no extra config?

  14. Zubair Mubarik

    Thank you for this article, Please advise me how to configure ADFs to Test this code.

    Thank you.

  15. Tim Wallace

    I'm new to SSO, ADFS and the like, but unfortunately I got thrown into a project that wants to use their legacy web forms login page but still use the ADFS federation to be able to seamlessly navigate to a partner's site without logging in there as well.  Is the idea of this project that I can build a request using the markup obtained by running your tool and then posting that page to achieve the login?

  16. Rodney Viana

    Tim,

    Federation is a different protocol that is covered in Windows Identity Foundation (WIF). There are several tutorials on how to do that. This is for SAML-Protocol which is not supported in WIF.

  17. Tim Wallace

    Rod, I don't/can't use passive federation because the client demands we use their login page.  So I am not fixated on using WIF if I cannot use that in addition to using the existing legacy login page.  I have not found an example of using active federation in a web forms app either, at least not one that relies upon classes and members of classes that have been deprecated.  So if you have any pointers on how I can tweak your code to work in my situation or some other way to accomplish my requirement, I'm all ears.

  18. Tim Wallace

    Rod, I replied earlier, but it appears not to have taken.  I cannot use passive federation since the client wants to use their legacy login page. I am open to options other than WIF. The client still wants to do SSO with partners, so somehow I have to get that security token from the ADFS box.  Any suggestions?

  19. Rodney Viana

    Tim,

    You need to use WS-Trust 1.3 to request a bearer token from ADFS and use this token to call the 3rd-party: leastprivilege.com/…/wcf-and-identity-in-net-4-5-external-authentication-with-ws-trust

  20. Tim Wallace

    Rod, thanks for the link.  I had already found that link.  My problem is that the sample code does not compile ( WSTrustChannelFactory no longer has a "Credentials" member, for example) and I am not familiar enough with the inner workings of WS-Trust to determine the current way of accomplishing what the sample code suggests.

  21. Rodney Viana

    Tim,

    Right now I am on vacation without a development environment. Post a question to the WIF forum at MSDN so someone can follow up with this. Don't forget to mention your .NET version.

  22. Daniel

    Where is the authentication?  Shouldn't you post the username, password and SAMLResponse to the relying party?

    I've extracted the contents of the authentication flow between browser -> RP, browser -> ADFS and browser -> RP again with Fiddler and wanted to replicate in code this without the ADFS login form showing. Its a poor man's version of single sign on.  

    Its similar to what you're doing, but its brute force and also could it be a kind of replay attack?

    What is the Single Sign On solution for Windows7 development using ADFS 3.0?

  23. Rodney Viana

    Daniel,

    Password is not passed over, but a NTLM or Kerberos token instead. SAML tokens do not contain a password, only the claims configured for the reliant party (RP). If the RP configuration includes a signing certificate even the claims are encrypted at message level, so Fiddler reverse-engineer is of no use.

    ADFS does not make a brute force attack any easier. My application (and library) is not getting any data that would not be available to the person authenticating.

  24. Michael Meinhardt

    Thanks Rodney! I banged my head against the wall for two weeks on this – There’s a dearth of information, most of it irrelevant. The frustrating part is I had done essentially what you did there – I recorded what was passed back from the IDP initiated login. The simplest answers are usually the best 🙂 – Thanks again for a great write-up!

    • paul

      So did you get this to work? Are you authenticating with ADFS in terms of retrieving specific information our to be authenticated for SSO purposes?

      We’re wanting to use our custom app to authenticate with ADFS for SSO purposes but without actually directing the user to the ADFS IdpInitiatedSignOn.aspx page. From what I’ve read and tried, this is not possible and the request to authenticate with ADFS to get an SSO token has to originate from the ADFS sign on page…

      What we’re wanting to do:: user signs into our custom app, custom app then authenticates said user to ADFS (“in the background”) returning the authenticated token back to our custom app. Now linking to any relying party trust apps connected to ADFS via our custom app the user will already be signed in….

      We are wanting to due this to to multiple reasons, including: our custom app has multiple audiences, both with AD accounts and those without.. 2. the ADFS sign on page is hardly customizable, wouldn’t be able to make it look anything like our custom app login page.

  25. Craig

    Hi Rodney,

    Currently working on a project where I need to extract the SAML2 Protocol Response just like you have with your C# code.

    When i run the downloaded page, either the pre-compiled form program or recompiled on my machine, i get the same issue as “Todd – October 23, 2014” posted.

    In my instance i can see get several get requests with returned header output (mainly cookie related) and then a heap of html and JavaScript code. No where in the output can i find the SAML Response.

    Just wondering if you have any ideas of what could be wrong? We are using our internal ADFS setup… Not AWS as Todd was.

    Cheers

    Craig

  26. Craig_Han

    Hi Rodney,

    Currently working on a project where I need to extract the SAML2 Protocol Response just like you have with your C# code.

    When i run the downloaded page, either the pre-compiled form program or recompiled on my machine, i get the same issue as “Todd – October 23, 2014” posted.

    In my instance i can see get several get requests with returned header output (mainly cookie related) and then a heap of html and JavaScript code. No where in the output can i find the SAML Response.

    Just wondering if you have any ideas of what could be wrong? We are using our internal ADFS setup… Not AWS as Todd was.

    Cheers

    Craig

  27. Craig_Han

    Hi Rodney,

    This looks great!!! I am currently working on a project where I need to extract the SAML2 Protocol Response just like you have with your C# code.

    When i run the downloaded page, either the pre-compiled form program or recompiled on my machine, i get the same issue as “Todd – October 23, 2014” posted.

    In my instance i can see get several get requests with returned header output (mainly cookie related) and then a heap of html and JavaScript code. No where in the output can i find the SAML Response.

    Just wondering if you have any ideas of what could be wrong? We are using our internal ADFS setup… Not AWS as Todd was.

    Cheers

    Craig

    • Rodney Viana - MSFT - SharePoint

      Hi Craig_Han,

      This was designed for ADFS 2.0. If you use ADFS 3.0 it will not work.
      I will revisit the code at some point to adapt to ADFS 3.0.