How to make an IdP SAML Request from an Azure Function?

Viewed 172

I have a simple C# web app implemented as a series of Azure Functions. I want to be able to redirect users to an external website, logging them in using SSO when they click a button in my app. The external website is an instance of Absorb. Absorb provides a guide to accomplish this through SSO using the ComponentSpace library which is a commercial product.

I want to use the ITfoxtec SAML 2.0 library as it is free and open source (although any free/open source library would do).

My questions are as follows:

  1. How do I add a Saml2Assertion to a Saml2AuthnResponse?
  2. How do I use a redirectBinding to return an HttpResponseMessage?

Here is what I have so far:

[FunctionName("GoToAbsorb")]
public static async Task<HttpResponseMessage> Run([HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = null)]HttpRequestMessage request, TraceWriter log)
{
    //  User is authenticated and here.
    

    //  SAML part starts here.
    Saml2Configuration configuration = new Saml2Configuration();
    configuration.SigningCertificate = GetCertificate(); // Returns an X509 Certificate
    configuration.AllowedAudienceUris.Add(configuration.Issuer);

    Saml2AuthnResponse samlResponse = new Saml2AuthnResponse(configuration);
    samlResponse.Destination = new Uri("https://sample.myabsorb.com/account/saml");
    samlResponse.Issuer = Environment.GetEnvironmentVariable("WEBSITE_SITE_NAME");
    samlResponse.Status = ITfoxtec.Identity.Saml2.Schemas.Saml2StatusCodes.Success;

    Saml2Subject subject = new Saml2Subject(new Saml2NameIdentifier("Id"));
    subject.SubjectConfirmations.Add(new Saml2SubjectConfirmation(new Uri("https://sample.myabsorb.com/account/saml")));

    var assertion = new Saml2Assertion(new Saml2NameIdentifier(Environment.GetEnvironmentVariable("WEBSITE_SITE_NAME")));
    assertion.Conditions = new Saml2Conditions()
    {
        NotBefore = DateTime.Now,
        NotOnOrAfter = DateTime.Now.AddMinutes(3),
    };
    assertion.Statements.Add(new Saml2AuthenticationStatement(new Saml2AuthenticationContext()
    {
        //  There does not appear to be an equivalent to the following line
        //  AuthnContextClassRef = new AuthnContextClassRef(SAMLIdentifiers.AuthnContextClasses.Password)
    }));


    //  How do I add the assertion to the response?
                

    Saml2RedirectBinding redirectBinding = new Saml2RedirectBinding();
    redirectBinding.Bind(samlResponse);
    
    //  What do I return as the response message?
    return new HttpResponseMessage(...);
}
1 Answers

I do not think it is possible to secure an Azure Function with SAML 2.0. SAML 2.0 is for web applications and not an API. You can secure an API by sending a SAML 2.0 token as part of the http header and validate the SAML 2.0 token in the API.

Related