Skip to main content

SAML Authenticator Web 8.5 with ADFS

This post continues the setup of Single Sign-On for Web 8.5 with ADFS presented in an earlier blog post.

This SAML Authenticator is a .NET HTTP Module that is configured to intercept all requests going into the SDL Web website (the CME) and do the following:
  • if request is post-back from ADFS
    • decrypt SAML token
    • extract user name
    • set cookie with user name
    • set user name in request SSO header
  • else
    • if cookie exists
      • extract user name from cookie
      • set user name in request SSO header
    • else
      • redirect browser to ADFS form-login
The cookie is encrypted, in order to prevent the user name from being spoofed.

In more detail, the code is as follows:

public void BeginRequest()
{
    string user = GetUserData();
    if (user == null)
    {
        Request.Headers.Remove(Configuration.HeaderUser);
    }
    else
    {
        Request.Headers[Configuration.HeaderUser] = user;
    }
}

The method executes when a request is intercepted. The configuration HeaderUser is the name of the SSO header that the SDL Web SsoAgentHttpModule is expecting to be set, in order to impersonate that user.

The method GetUserData:

private string GetUserData()
{
    string result = null;
    SamlResponse samlResponse;

    if ((samlResponse = new SamlResponse()).IsValid)
    {
        UserData user = samlResponse.ExtractUser();

        if (user == null)
        {
            new SamlRequest().ForceLogin();
        }
        else
        {
            Response.SetCookie(new HttpCookie(Configuration.CookieName, Util.RsaEncrypt(user.UserId)));

            if (string.IsNullOrEmpty(user.OriginalUrl))
            {
                result = user.UserId;
            }
            else
            {
                Response.Redirect(user.OriginalUrl);
            }
        }
    }
    else
    {
        HttpCookie cookie = Request.Cookies[Configuration.CookieName];

        if (cookie == null)
        {
            new SamlRequest().ForceLogin();
        }
        else
        {
            result = Util.RsaDecrypt(cookie.Value);
            if (result == null)
            {
                new SamlRequest().ForceLogin();
            }
        }
    }

    return result;
}

The classes SamlRequest and SamlResponse handle the request redirect to ADFS login, and response token handling respectively.

SamleResponse.ExtractUser method is presented below:

public UserData ExtractUser()
{
    UserData user = new UserData();

    AdfsClient adfsClient = new AdfsClient();
    Saml2SecurityToken token = adfsClient.DecryptSaml2Token(SamlResponseXml);
    IPrincipal principal = adfsClient.GetPrincipal(token);

    ExtractClaims(principal, user);

    return user;
}

The code above makes use of the custom AdfsClient class, which handles communication and token handling with the ADFS server.

The code first decodes the SAML encrypted XML and converts the string representation of the token into a .NET System.IdentityModel.Tokens.Sam2SecurityToken object.

public Saml2SecurityToken DecryptSaml2Token(string tokenXml)
{
    using (StringReader stringReader = new StringReader(tokenXml))
    using (XmlReader reader = XmlReader.Create(stringReader))
    {
        reader.ReadToFollowing("EncryptedAssertion", SAML2_ASSERTION);
        return (Saml2SecurityToken)SecurityTokenHandlers.ReadToken(reader);
    }
}

public ClaimsPrincipal GetPrincipal(SecurityToken decryptedToken)
{
    ReadOnlyCollection<ClaimsIdentity> identities = SecurityTokenHandlers.ValidateToken(decryptedToken);
    return new ClaimsPrincipal(identities[0]);
}

The latter method, GetPrincipal, validates the decrypted token and by doing so, it creates a collection of ClaimsIdentity objects contained in that token. We then return a new ClaimsPrincipal instance based on the first identity in the token.

Lastly, the SamlRequest.ForceLogin method simply outputs an HTML document that automatically performs a JavaScript POST to the ADFS passive-authentication login-form. It also passes in the Relying Party identifier for this application (without such an identifier, the ADFS won't show the form-login screen).

We must also configure the HTTP Module in file web.config of the SDL Web website, located in folder [SDLWebHome]\web.


Comments

Popular posts from this blog

Running sp_updatestats on AWS RDS database

Part of the maintenance tasks that I perform on a MSSQL Content Manager database is to run stored procedure sp_updatestats . exec sp_updatestats However, that is not supported on an AWS RDS instance. The error message below indicates that only the sa  account can perform this: Msg 15247 , Level 16 , State 1 , Procedure sp_updatestats, Line 15 [Batch Start Line 0 ] User does not have permission to perform this action. Instead there are several posts that suggest using UPDATE STATISTICS instead: https://dba.stackexchange.com/questions/145982/sp-updatestats-vs-update-statistics I stumbled upon the following post from 2008 (!!!), https://social.msdn.microsoft.com/Forums/sqlserver/en-US/186e3db0-fe37-4c31-b017-8e7c24d19697/spupdatestats-fails-to-run-with-permission-error-under-dbopriveleged-user , which describes a way to wrap the call to sp_updatestats and execute it under a different user: create procedure dbo.sp_updstats with execute as 'dbo' as

Content Delivery Monitoring in AWS with CloudWatch

This post describes a way of monitoring a Tridion 9 combined Deployer by sending the health checks into a custom metric in CloudWatch in AWS. The same approach can also be used for other Content Delivery services. Once the metric is available in CloudWatch, we can create alarms in case the service errors out or becomes unresponsive. The overall architecture is as follows: Content Delivery service sends heartbeat (or exposes HTTP endpoint) for monitoring Monitoring Agent checks heartbeat (or HTTP health check) regularly and stores health state AWS lambda function: runs regularly reads the health state from Monitoring Agent pushes custom metrics into CloudWatch I am running the Deployer ( installation docs ) and Monitoring Agent ( installation docs ) on a t2.medium EC2 instance running CentOS on which I also installed the Systems Manager Agent (SSM Agent) ( installation docs ). In my case I have a combined Deployer that I want to monitor. This consists of an Endpoint and a

SDL Web 8 - Content Delivery Microservices

Among the new features in SDL Web 8 there are the Content Delivery Microservices, namely: Audience Manager Content Deployer Contextual Image Delivery Discovery Service Dynamic Content Dynamic Linking Profiling and Personalization Metadata Query Taxonomy User Generated Content These microservices make up the Content Interaction Services and they expose the existing Content Delivery in-process APIs as RESTful services. They provide the server-side component in a Services-Oriented Architecture and act as data layer between the the web client and the Content Delivery Storage Layer. According to the SDL marketing, these microservices: Simplify upgrades, thus offering shorter time to value Modernize architecture, offering better separation between the web application and Tridion APIs Offer more flexibility with less downtime and improved scalability Improve quality, being self-running, contained and having less dependencies In technical words, these microservices