Migrating an ASP application to ADFS authentication

I recently built an ASP. Application at work-to-help track internal It ' s been really well received, but only a few days after launch one of our managers came over and asked if we could move The site to Azure so, people didn ' t need to is in the office or on the VPN. Getting sites published on Azure itself are fairly easy with the publishing tools in Visual Studio-but dealing with authe Ntication itself is a bit more difficult. The site uses Windows authentication-not something suitable for use on Azure.

There seem to is a few options when migrating away:

* Windows Azure Active Directory (effectively replicate your AD into Azure)
* Azure Access Control Services (now deprecated)
* On Premise ADFS (can is made public for authentication outside the office)

Given ACS is deprecated and we already had a ADFS server I went down the ADFS route. It ' s not as easy as it should be-you can ' t change the authentication option easily in VS. After you ' ve created a pro Ject. Here's how I did it:

(Throughout the following, replace with the hostname of your application and with the hostname of your ADFS server)

Open your web. config file

Add the following to (or create if necessary) the configsections element:

<configSections>
<section name= "System.identitymodel" type= "System.IdentityModel.Configuration.SystemIdentityModelSection, System.identitymodel, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089 "/>
<section name= "system.identityModel.services" type= " System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089 "/>
</configSections>

Add the following to (or create if necessary) the AppSettings element:

<appSettings>
<add key= "ida:federationmetadatalocation" value= "https://<sts.local>/federationmetadata/2007-06/ Federationmetadata.xml "/>
<add key= "Ida:realm" value= "https://<app.local>/"/>
<add key= "Ida:audienceuri" value= "https://<app.local>/"/>
</appSettings>

Change the authentication mode to None:

<authentication mode= "None"/>

ADD The following configuration sections:

<system.webServer>
<modules>
<add name= "Wsfederationauthenticationmodule" type= " System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, version=4.0.0.0, Culture=neutral, publickeytoken=b77a5c561934e089 "precondition=" Managedhandler "/>
<add name= "Sessionauthenticationmodule" type= "System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, version=4.0.0.0, Culture=neutral, publickeytoken=b77a5c561934e089 "precondition=" Managedhandler "/>
</modules>
</system.webServer>
<system.identityModel>
<identityConfiguration>
<audienceUris>
<add value= "https://<app.local>/"/>
</audienceUris>
<securityTokenHandlers>
<add type= "System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, version=4.0.0.0, culture=neutral, publickeytoken=b77a5c561934e089 "/>
<remove type= "System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.identitymodel, version=4.0.0.0, Culture=neutral, publickeytoken=b77a5c561934e089 "/>
</securityTokenHandlers>
<certificatevalidation certificatevalidationmode= "None"/>
<issuernameregistry type= "System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry ">
<authority name= "Http://<sts.local>/adfs/services/trust" >
<keys>
<add thumbprint= "<thumbprint>"/>
</keys>
<validIssuers>
<add name= "Http://<sts.local>/adfs/services/trust"/>
</validIssuers>
</authority>
</issuerNameRegistry>
</identityConfiguration>
</system.identityModel>
<system.identityModel.services>
<federationConfiguration>
<cookiehandler requiressl= "true"/>
<wsfederation passiveredirectenabled= "true" issuer= "https://<sts.local>/adfs/ls/" realm= "https://< app.local>/"requirehttps=" true "/>
</federationConfiguration>
</system.identityModel.services>

Add the following references

System.identitymodel
System.IdentityModel.Services
System.IdentityModel.Tokens.ValidatingIssuer

You are need to register your app with the ADFS server as a "relying party"

Migrating an ASP application to ADFS authentication