0
  • EDIT: Updated question as I was able to solve part of the issue thanks to lehuspohus!*

I have fetched a SAML Token from AD FS for the Relying Party I have set up with my local SharePoint server using Postman.

How do I format and where do I post the response from AD FS to authenticate with SharePOint:

UPDATE - Working solution added thanks to lehupohus is below: I can authenticate with SharePoint with this by submitting it as part of a url-encoded-form that looks like this: wa=wsignin1.0&wresult=<Encoded SAML Token>&wctx=https://server/_layouts/15/Authenticate.aspx?Source=/ to https://server/_trust/ and I get a whole page back in the response body along with the FedAuth access token*.

Follow on questions which I believe the answers are no.

  1. Is there an endpoint that I can submit just the XML/SOAP to (where and what does that look like?)

  2. Can I just retrieve the FedAuth access token only (without the rest of the html page).

<trust:RequestSecurityTokenResponse>
        <trust:Lifetime>
            <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2022-10-19T16:56:36.105Z</wsu:Created>
            <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2022-10-19T17:56:36.105Z</wsu:Expires>
        </trust:Lifetime>
        <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
            <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
                <wsa:Address>urn:sharepoint:spsites</wsa:Address>
            </wsa:EndpointReference>
        </wsp:AppliesTo>
        <trust:RequestedSecurityToken>
            <saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="_3519cbe0-66fb-4bc3-9a40-91ea06cb0ad7" Issuer="http://ms-adfs.intranet/adfs/services/trust" IssueInstant="2022-10-19T16:56:36.230Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
                <saml:Conditions NotBefore="2022-10-19T16:56:36.105Z" NotOnOrAfter="2022-10-19T17:56:36.105Z">
                    <saml:AudienceRestrictionCondition>
                        <saml:Audience>urn:sharepoint:spsites</saml:Audience>
                    </saml:AudienceRestrictionCondition>
                </saml:Conditions>
                <saml:AttributeStatement>
                    <saml:Subject>
                        <saml:SubjectConfirmation>
                            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                        </saml:SubjectConfirmation>
                    </saml:Subject>
                    <saml:Attribute AttributeName="emailaddress" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
                        <saml:AttributeValue>[email protected]</saml:AttributeValue>
                    </saml:Attribute>
                </saml:AttributeStatement>
                <saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:X509-PKI" AuthenticationInstant="2022-10-19T16:56:35.639Z">
                    <saml:Subject>
                        <saml:SubjectConfirmation>
                            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                        </saml:SubjectConfirmation>
                    </saml:Subject>
                </saml:AuthenticationStatement>
                <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                    <ds:SignedInfo>
                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                        <ds:Reference URI="#_3519cbe0-66fb-4bc3-9a40-91ea06cb0ad7">
                            <ds:Transforms>
                                <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                            </ds:Transforms>
                            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                            <ds:DigestValue>gTz6J3z40UUkqOf1DV3gAe4yel5AD0GVPCJ7xI6ac44=</ds:DigestValue>
                        </ds:Reference>
                    </ds:SignedInfo>
                    <ds:SignatureValue>ftyI5grqS01/g9zpfUuPn24xXMvJ...</ds:SignatureValue>
                    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                        <X509Data>
                            <X509Certificate>MIICxDCCAaygAwIBAgIQEqN9pL4STbx...</X509Certificate>
                        </X509Data>
                    </KeyInfo>
                </ds:Signature>
            </saml:Assertion>
        </trust:RequestedSecurityToken>
        <trust:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</trust:TokenType>
        <trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>
        <trust:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</trust:KeyType>
    </trust:RequestSecurityTokenResponse>
Improve this question
2
  • Have you tried to use a different endpoint (as i described in my last answer's comment) to mitigate the need to fetch the full html? You'll get small json instead, with the current user info. You can also use just /_api/web/CurrentUser endpoint (without authenticate.aspx) to check if the authentication succeeded based on the 403 response code.
    – lehuspohus
    Commented Nov 8, 2022 at 15:37
  • @lehuspohus thanks, I did try that indeed! It is a smaller XML response which will be useful!
    – PKCS12
    Commented Nov 8, 2022 at 15:42

1 Answer 1

Reset to default
1
+50

SAML Token for on-premises SharePoint should be POSTed to https://server/_trust/ endpoint.
Of course, the farm should be already configured for SAML authentication.

Specifically, Body header should look like:
wa=wsignin1.0&wresult=<YourSAMLToken>&wctx=https://server/_layouts/15/Authenticate.aspx?Source=/
but I doubt that your token matches the format Sharepoint expects and that you can reproduce this behaviour easily with Postman.

Improve this answer
5
  • Thank you, that is very helpful - do you know of any guide of where I might be able to find out what I need to do with the token to match what SharePoint expects? I can also code this in C# so if any library or coding example exists, sending me it would be super! Thank you again for your input
    – PKCS12
    Commented Oct 21, 2022 at 17:06
  • Your token is already very similar to those that I saw in my configuration, but with some minor differences. Unwrap "RequestSecurityTokenResponse, i.e. remove all tags above ", add "trust" namespace definition as xmlns:trust="schemas.xmlsoap.org/ws/2005/02/trust". Also, delete tags <RequestedAttachedReference>, <RequestedUnattachedReference> and replace <RequestType> value with "schemas.xmlsoap.org/ws/2005/02/trust/Issue" and <KeyType> with "schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey" and you will get pretty much the same as I have. But it looks as manual fitting )
    – lehuspohus
    Commented Oct 22, 2022 at 19:55
  • 1
    I think, the best way to know what exact format of token is used at your SharePoint farm is to look for browser authentication with Fiddler and try to reproduce it. I'm not a developer so unfortunately I can't give you advice on libraries and samples. If you are developing a mobile app, then probably a better way would be to use WebView and let "browser" make all redirects and requests, then grab a FedAuth cookie and use it in all consequent requests. Even MS Project Windows client connects to server (SharePoint) and opens a dialogue "browser" window to make an authentication with ADFS.
    – lehuspohus
    Commented Oct 22, 2022 at 20:12
  • Thanks to your pointers I have been able to fetch access token fedAuth! The remaining question I have is whether there is an endpoint that does not return an entire web page as I only need the access token (fedAuth cookie)! I was looking at /_vti_bin/authentication.asmx and that accepts a soap login (with username/password) but not a token. Any chance you have suggestions please?
    – PKCS12
    Commented Nov 2, 2022 at 16:19
  • Oh yeah, SharePoint loves to redirect to home page and load all that stuff. I'm not sure, but you can try to use an _api endpoint in a Source query string parameter that will not be overwritten when you'll call Authenticate.aspx: /_layouts/Authenticate.aspx?Source=/_api/web/CurrentUser
    – lehuspohus
    Commented Nov 3, 2022 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.