The ClaimsProxy library enables you to get a WIF cookie collection for a SharePoint site which is protected by Claims Based Authentication. It assumes that ADFS is configured as the Trusted Identity Token Issuer and that the down-stream identity provider is based on the StarterSTS / IdentityServer project.
In some recent work I needed to call some SharePoint 2010 web services from a client outside of the SharePoint farm. Using traditional network credentials and Windows Authentication this was a straightforward matter, for example:
ICredentials credentials = new NetworkCredential('username', 'password', 'domain');
SharepointUserGroupsWCF.UserGroupSoapClient client = new SharepointUserGroupsWCF.UserGroupSoapClient();
client.ClientCredentials.Windows.ClientCredential = (NetworkCredential)credentials;
client.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;
client.Endpoint.Address = new EndpointAddress(webPath + "/_vti_bin/usergroup.asmx");
XElement groupXml = client.GetGroupCollectionFromSite();
However, when the target service is protected by Claims Based Authentication, it’s not so straightforward to call such services. In my scenario I had a SharePoint 2010 site protected in a web application configured with Claims Based Authentication. I had configured SharePoint to direct authentication to ADFS (Microsoft Active Directory Federation Server), and then I had a custom claims provider configured based on Dominick Baier’s Identity Server open source STS product (formerly StarterSTS), however my approach could easily be adapted to work with any number of final claims providers.
Even if you just want the code, read this bit first.
I’ve implemented the code as a .NET 4.0 assembly, although it should be relatively easy to get it to compile under .NET 3.5. The overall approach works as follows:
- Use username + password to request a symmetric token from our custom STS (you could get a Windows token here or whatever you are using) – set the realm to that configured for ADFS
- Use that token to request a bearer token from ADFS – set the realm to the SharePoint site realm as configured in ADFS
- Use the token from ADFS to authenticate with SharePoint
- From the resulting authentication response, extract the WIF (Windows Identity Foundation) cookie for authentication (commonly named FedAuth)
- Return this cookie to the client
I have included a test application in the solution which demonstrates using the returned cookie to make a call to a web service in the SharePoint site. I’ve left the responsibility of caching the cookie to the client (but included this in the test app).
IMPORTANT NOTE: There is one modification required to the library which I haven’t done yet. If you read the finer details of WIF you will know that if the SAML token data is too large for a single cookie, then WIF spreads the data over multiple cookies named FedAuth1, FedAuth2 … FedAuthN. The library assumes that there is only one FedAuth cookie at present – which will be sufficient for most applications – but its worth keeping an eye on if you’re running into troubles. I will get around to sorting this at some point, but feel free to make a pull request on my Github repository if you get there first.
Download the ClaimsProxy library and sample application from Github
ClaimsProxy is straightforward to use:
// configure our SPServiceRequestor.
var requestor = new SPServiceRequestor
{
DobstsEndpoint = "https://startersts.yourdomain.com/startersts/users/issue.svc/mixed/username",
DobstsUsername = "joe.bloggs@yourdomain.com",
DobstsPassword = "password",
DobstsAdfsRealm = "https://adfs.yourdomain.com/adfs/ls/",
AdfsEndpoint = "https://adfs.yourdomain.com/adfs/ls/",
SharepointRealm = "urn:sharepoint:sp.yourdomain.com",
SharepointSiteUrl = "https://sp.yourdomain.com/",
IgnoreSslValidation = true,
DebugMode = true,
DebugEventCallback = (data) =>
{
// your debug function here
}
};
string spCookieRaw = requestor.GetCookie();
N.B.: DobSts is our own implementation of the StarterSTS project.
Check out the sample application for a full example of how to use the library.
I’d welcome any comments / feedback on this – hopefully it will be of some use to others out there, it certainly has been to me.
