My ultimate goal is to add SSO (WS-Fed) to an existent Web Forms application (let's call it OrigApp). I already have my app (SP)'s relying party trust ready.
My strategy is first to create an off-the-shelf Web Forms app (let's call it NewApp), and then I will add all appropriate code from OrigApp.
I have already created the Web Forms NewApp (.NET Framework 4.7.2) with the appropriate IdP and my app (SP) urls.
I have tested it and SSO works just fine.
Before I add the code from OrigApp, i am inspecting the code in NewApp, I noticed the following, and I have some questions (listed at the end of the things noticed):
web.config now has a whole bunch of references to assemblies (Microsoft.IdentityModel.Tokens, Microsoft.IdentityModel.Tokens.Saml, Microsoft.IdentityModel.Protocols.OpenIdConnect, Microsoft.IdentityModel.Protocols, etc) to support SSO. This makes sense.
Global.asax.cs has this on Application_Start():
void Application_Start(object sender, EventArgs e)
{
// Code that runs on application startup
RouteConfig.RegisterRoutes(RouteTable.Routes);
BundleConfig.RegisterBundles(BundleTable.Bundles);
}
- There is now a Startup.cs
public partial class Startup { public void Configuration(IAppBuilder app) { ConfigureAuth(app); } }
ConfigureAuth() is in StartupAuth.cs :
public partial class Startup { private static string realm = ConfigurationManager.AppSettings["ida:Wtrealm"]; private static string adfsMetadata = ConfigurationManager.AppSettings["ida:ADFSMetadata"];
public void ConfigureAuth(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseWsFederationAuthentication(
new WsFederationAuthenticationOptions
{
Wtrealm = realm,
MetadataAddress = adfsMetadata
});
// This makes any middleware defined above this line run before the Authorization rule is applied in web.config
app.UseStageMarker(PipelineStage.Authenticate);
}
}
As I said before, I have tested NewApp and SSO works. My question is, where is the SSO config being called?
As far as I know, ASP.NET will first Application_Start() in Global.asax.cs, which, as I shown above, I don't see that any code from the Startup.cs is called from Application_Start() in Global.asax.cs.
I read that with .NET 5 Startup.cs is used in a similar way than Global.asax.cs Is .Net Framework 4.7.2 considered .NET 5? or is Startup.cs being called by the .Net Framework in 4.7.2 already?
If so, does it call Application_Start() from Global.asax.cs first, and then which method in Startup.cs? Configuration?
public partial class Startup { public void Configuration(IAppBuilder app) { ConfigureAuth(app); } }
So in summary, I need to understand where exactly is the code that handles the SSO called? I also checked Default.aspx.cs and it is empty.