OpenId Connect Web Sign On with ADFS in Windows Server 2016 TP3
Enabling OpenId Connect with AD FS 2016
Vittorio's article (the first one) is also good for configuring ADFS, setting up AD, promoting it as a DC etc.
I ran up the server as an Azure VM.
I used the second article.
Note that this is obviously copied and pasted from somewhere else because there are a number of errors:
- You don't need an Azure subscription
- You don't need to do any Web API configuration
- You don't need the secret key, only the ClientID
I added more scopes so I had:
email, profile and openid
When you run up the sample, you may get an error along the lines of:
"The certificate is invalid according to the criteria".
To fix this, you have to add the ADFS SSL certificate to the client's trusted certificate store.
After successful authentication, using the Firefox SAML tracer, look at the response and you will see a parameter called "code" and another called "id_token".
The code is the access token which you can then use if e.g. you want to call a Web API.
The id_token is Base64 encoded and in JWT format so cut and paste it into Auth0's:
and you will see something like:
Now if you use the code from an earlier blog post to display the claims on the "Contact" page i.e.
ViewBag.ClaimsIdentity = Thread.CurrentPrincipal.Identity;
|Claim Type||Claim Value|
What's interesting is that you can't add claims rules in the ADFS wizard to a web site application group so e.g. the NameID is a GUID!
You'll notice the claims are a combination of OAuth and the old "WIF style".