Code

The SAML 2.0 package is integrated into a ASP.NET MVC application by adding an Auth Controller and implementing the following four methods. The binding shown can be changed as needed depending on the requirements.

It is furthermore possible to set some optional parameters on the Saml2AuthnRequest and Saml2LogoutRequest. On the Saml2AuthnRequest e.g. ForceAuthn is supported, which will force the user to enter login credentials even though an SSO context already exists on the Security Token Service (STS) in this case a AD FS.

Login method in the Auth Controller

The example shows how to use the RequestedAuthnContext, which can be omitted.

public ActionResult Login(string returnUrl)
{
    var binding = new Saml2RedirectBinding();
    binding.SetRelayStateQuery(new Dictionary<string, string> { { "ReturnUrl", returnUrl } });

    return binding.Bind(new Saml2AuthnRequest
        {
            RequestedAuthnContext = new RequestedAuthnContext
            {
                Comparison = AuthnContextComparisonTypes.Exact,
                AuthnContextClassRef = new string[] { AuthnContextClassTypes.PasswordProtectedTransport.OriginalString }, 
            },
            Issuer = new EndpointReference("http://udv.itfoxtec.com/webapptest"),
            Destination = new EndpointAddress("https://udv.itfoxtec.com/adfs/ls/"),
            AssertionConsumerServiceUrl = new EndpointAddress("https://udv.itfoxtec.com/webapptest/Auth/AssertionConsumerService")
        }).ToActionResult();
}

AssertionConsumerService method in the Auth Controller

After successfully or failing login the ACS method receiver the response.

public ActionResult AssertionConsumerService()
{
    var binding = new Saml2PostBinding();
    var saml2AuthnResponse = new Saml2AuthnResponse();

    binding.Unbind(Request, saml2AuthnResponse, CertificateUtil.Load("~/App_Data/signing-adfs.test_Certificate.crt"));
    saml2AuthnResponse.CreateSession();

    var returnUrl = binding.GetRelayStateQuery()["ReturnUrl"];
    return new RedirectResult(string.IsNullOrWhiteSpace(returnUrl) ? Url.Content("~/") : returnUrl);
}

Logout method in the Auth Controller

public ActionResult Logout()
{
    if (!User.Identity.IsAuthenticated)
    {
        return Redirect(Url.Content("~/"));
    }

    var binding = new Saml2PostBinding();
    return binding.Bind(new Saml2LogoutRequest
        {
            Issuer = new EndpointReference("http://udv.itfoxtec.com/webapptest"),
            Destination = new EndpointAddress("https://udv.itfoxtec.com/adfs/ls/")
        },
        CertificateUtil.Load("~/App_Data/webapptest_certificate.pfx")).ToActionResult();
}

LoggedOut method in the Auth Controller

After successfully or failing logout the logged out method receive the response.

public ActionResult LoggedOut()
{
    var binding = new Saml2RedirectBinding();
    binding.Unbind(Request, new Saml2LogoutResponse(), CertificateUtil.Load("~/App_Data/signing-adfs.test_Certificate.crt")).DeleteSession();

    return Redirect(Url.Content("~/"));
}

SingleLogout method in the Auth Controller

Receives a Single Logout request and send a response.

public ActionResult SingleLogout()
{
    Saml2StatusCodes status;
    var requestBinding = new Saml2RedirectBinding();
    var logoutRequest = new Saml2LogoutRequest();
    try
    {
        requestBinding.Unbind(Request, logoutRequest, CertificateUtil.Load("~/App_Data/signing-adfs.test_Certificate.crt"));
        status = Saml2StatusCodes.Success;
    }
    catch (Exception exc)
    {
        // log exception
        Debug.WriteLine("SingleLogout error: " + exc.ToString());
        status = Saml2StatusCodes.RequestDenied;
    }

    var responsebinding = new Saml2RedirectBinding();
    responsebinding.RelayState = requestBinding.RelayState;
    var saml2LogoutResponse = new Saml2LogoutResponse
    {
        InResponseTo = logoutRequest.Id,
        Status = status,
        Issuer = new EndpointReference("http://udv.itfoxtec.com/webapptest"),
        Destination = new EndpointAddress("https://udv.itfoxtec.com/adfs/ls/")
    };
    saml2LogoutResponse.DeleteSession();
    return responsebinding.Bind(saml2LogoutResponse, CertificateUtil.Load("~/App_Data/webapptest_certificate.pfx")).ToActionResult();        
}