3

I've got a phone gap application which should contact ADFS with a RST to obtain a SAML token then should pass this token to STS to obtain a FedAuth Cookie which is finally used in the header of REST calls.

I'm contacting ADFS with this envelope:

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
    <a:Action s:mustUnderstand="1">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</a:Action>
    <a:To s:mustUnderstand="1">https://host/adfs/services/trust/13/UsernameMixed</a:To>
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <o:UsernameToken u:Id="uuid-6a13a244-dac6-42c1-84c5-cbb345b0c4c4-1">
            <o:Username>myUser</o:Username>
            <o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">myPassword</o:Password>
        </o:UsernameToken>
    </o:Security>
</s:Header>
<s:Body>
    <trust:RequestSecurityToken xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
        <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
            <a:EndpointReference>
                <a:Address>https://host/adfs/ls</a:Address>
            </a:EndpointReference>
        </wsp:AppliesTo>
        <trust:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</trust:KeyType>
        <trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>
        <trust:TokenType>urn:oasis:names:tc:SAML:2.0:assertion</trust:TokenType>
    </trust:RequestSecurityToken>
</s:Body>

this is the response that i obtain:

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
    <a:Action s:mustUnderstand="1">http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTRC/IssueFinal</a:Action>
    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
        <u:Timestamp u:Id="_0">
            <u:Created>2014-10-27T13:01:36.732Z</u:Created>
            <u:Expires>2014-10-27T13:06:36.732Z</u:Expires>
        </u:Timestamp>
    </o:Security>
</s:Header>
<s:Body>
    <trust:RequestSecurityTokenResponseCollection xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
        <trust:RequestSecurityTokenResponse>
            <trust:Lifetime>
                <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2014-10-27T13:01:36.717Z</wsu:Created>
                <wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2014-10-27T21:01:36.717Z</wsu:Expires>
            </trust:Lifetime>
            <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
                <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
                    <wsa:Address>https://host/adfs/ls/</wsa:Address>
                </wsa:EndpointReference>
            </wsp:AppliesTo>
            <trust:RequestedSecurityToken>
                <SecurityContextToken u:Id="_641d53b3-6cee-4817-968c-1e03fdd9a598-FEA940F2E5E8BD29F68ACF2E3319296A" xmlns="http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512">
                    <Identifier>urn:uuid:092f0aee-2e3a-4829-9b1e-3cf2547e5180</Identifier>
                    <Instance>urn:uuid:73679764-2488-4043-b5ad-515634acb8bc</Instance>
                    <Cookie xmlns="http://schemas.microsoft.com/ws/2006/05/security">R4mn/nFoltSCP+Lr3BT2BkHw+T8hNC0q/3COZnH8RoEAAQAALhTRFiUCLnyWnvt+bmx7oTB/g0sK6yVULtIWlu0uDn2lQju6bbPjWgFPaUZBDBwc6WCDQcajat5M/dRfxgJkSI6JAH9w92cikkP143h3jE1gYcz8siGYAfLjcacvFW8NTiyVhdNoMbjoDxpdFTe7w/pDNJHTadIKBSimbLI2qIf2ziOFJkbxUtF5a2UceFJ4gr2SQwPew6f2/vIN7Ber7HjmYxKGV1DnBUcczM0yCw9o8iuCeBxRxUHpZ7fR4eYqZHlUrPyt5FRlvNCpPQqna5Nl/9eABtKSQ0LiAzmHYfC9IAx17Dg8gwXn1gLUtUYXcpA2fA2AIwkNMt49lP2GT5AEAAB7heKSXILdZ4NeVkU+NjoGsh4hk2RZwVyOTLEriJjDTyJeIYH1nc2eVtmmGYVecK1CkHbAnPXwbTXzqypyp/J370O19HvKKZ8LyWUOeU4g0e+kvnKxubPupR0MtDP8gGHT2w6P3aibz+xi8oJZW8cqMQOb2YqChMopqNpaKBusXVjkA+lnG6Rfr7dP60CihXZUhCndQ2ucKZ2B7J3yINmhV+E6aoypBxhBm/UZsVFvHVAxURaaQG40Y/FmbXl9vaRosU5WfGovj7o2d48tdINpSGMRik66x9sUaETIuJJcY8b8Srp8noDdl8y4gJQGixc8W7jGdhViz9+/jWK7d962KwSrr8+3tQ5tB5fYr2W+SJq85W8aKaeqr2VaJhl75xesDBPMmd2lyKRZzrNDtqpFZjgrDrSZhpkABxP29FjfywIGD0q5r/2dqc4gZRpUtWVLxf/2nxK48dAZsAb1LdhmDejHptfkbvaCieFsMdbwck5AUMV5SEoq1YmyO7SaBVV1WnmUCDWW4xek9pe/NpRvcAX6EEfZ2Ai1jusKO9kfHScgzChY+iDYduijDZCBGrPMR5DmoVIhE1DyxQfwQX5LALNVMQWY3kLUGjhl71o6+I+3oeWBI+RJn3LRiXdbq03zqss5gPsxRGHNdx+pkIjNw+LSQEx2BkUKbikDZTHat2NROHIDScJJU0YWlfyg7iUk9ey53sIasz/bEa8c7CMxkLTGs8nui6+IMX8eXQjmSlgUQx+Uc/uoNn3R1wjYBFK2bGViaWj3jDHpvxIwPNHkgHaeOFngl7Q068eovBnjfTa0PW+hHyUivbXhbmnQTN1i3jaRiu7x8tqsV/ICr3V4gUqaIq5QnP1c0rrBVVpy4hB+BaBm0yXcio0uHDFfWJzEskLpxN6+bU2+XJPXifRxET+AlllLqmgqHyBZXIydHQdubG4zYeubPk9gbvxZCLSEoNgPEML2O9ITlcWALbEKJ/8MEpjes7/demKGKbhHR0YP4tPI582CmoDHE+tqbvD35zfm7TTkH4IVSDDoYmbQdJQCC97ggKtUGtZtXSjIHDQf2g11zyB2jv0J/TDJzqDAou/MyXkTbsMN1B/JdcyhyYR34KgeqIC/TbTE5YUEzv63sP2iGG+LMO8q6EG0wWvEFXb03PZbfF87v+QN9oSzLP0apaC7YRwqTJxywRCg0kL3MA/B2+KS3DmwmiGLZGuTHz79jgzmiXk4zTscDErZo+EPABM1KN9DrU5bx6jYoO2s4UiOeZ9c64EBIn1PsGFWr+EA2DuZ/nAjfz/lQ6pZpwBV3zjn3Kwz49YH3zp7raUXced4UyeyDsTnCgF/lNlPMyW6xdm4qOtB4zmglv17WkSHUi22g8SiaK1TsAR2dCAYWDkzadoQXeK0XwUDnlpRR+nzgfn3N8vPfKqY5pt3sxwGIPSiPahdiCpFsk7GW7h6J06meGn8q5CzD/4BPd9yVZ4G1Op8HrKyywjKRjV50UgTnTtp9RMEK0t9zfQdHV6aVNm+oCDOBIq78OquAhqXNhXa4Zj5bsMfcIhB0kDo</Cookie>
                </SecurityContextToken>
            </trust:RequestedSecurityToken>
            <trust:TokenType>urn:oasis:names:tc:SAML:2.0:assertion</trust:TokenType>
            <trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>
            <trust:KeyType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer</trust:KeyType>
        </trust:RequestSecurityTokenResponse>
    </trust:RequestSecurityTokenResponseCollection>
</s:Body>

what should i do?

they told me i need to send this token to this url https://host/_vti_bin/sts/spsecuritytokenservice.svc/cookie to obtain the FedAuth Cookie, but i don't know how... i've wrote this function, but i always receive 400 bad request.

token is the content of tag <Cookie>, but i've also tried to pass the entire xml, or portions of it...

wsignin: function(token){
        console.log('start wsignin' );
        console.log('wsignin token:'+token );
        $.ajax({
            'url': 'https://host/_vti_bin/sts/spsecuritytokenservice.svc/cookie',
            dataType: 'text',
            contentType: 'application/soap+msbin1',
            type:'POST',
            'data':token,
            headers: {
                Accept : "application/soap+msbin1"
            },
            success: function(result, textStatus, jqXHR) {
                console.log('done wsignin ' + result);
            },
            error:function (jqXHR, textStatus, errorThrown){
                console.log('error wsignin:' + jqXHR.responseText);
            },
            complete:function(jqXHR, textStatus) {
                console.log('complete wsignin ' + textStatus);

            }
        });
        console.log('end wsignin' );
    }

any help will be very appreciate, thanks!

2
  • Can you just submit form (make post-call) with "wa", "wresult", "wctx" fields to /_trust/default.aspx and receive cookie (as in standard SharePoint auth process)? Nov 3 '14 at 20:18
  • Did you find the solution , i have the same isssue here. and would please share how did you contact the ADFS ? thank you
    – Imen Turki
    Jan 5 '20 at 21:42
1
namespace SPClient
{
    class FedAuthUtility
    {
        public Cookie GetAuthCookie(String Url, String uname, String pswd)
        {

            CookieContainer CookieJar = new CookieContainer();
            Uri authServiceUri = new Uri(Url+ "/_vti_bin/authentication.asmx");
            HttpWebRequest spAuthReq = HttpWebRequest.Create(authServiceUri) as HttpWebRequest;
            spAuthReq.CookieContainer = CookieJar;
            spAuthReq.Headers["SOAPAction"] = "http://schemas.microsoft.com/sharepoint/soap/Login";
            spAuthReq.ContentType = "text/xml; charset=utf-8";
            spAuthReq.Method = "POST";
            string envelope =
                "<?xml version=\"1.0\" encoding=\"utf-8\"?>" + "<soap:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\">"
                + "<soap:Body>"
                + "<Login xmlns=\"http://schemas.microsoft.com/sharepoint/soap/\">"
                + "<username>{0}</username>"
                + "<password>{1}</password>"
                + "</Login>" + "</soap:Body>"
                + "</soap:Envelope>";
            string userName = uname;
            string password = pswd;
            envelope = string.Format(envelope, userName, password);
            StreamWriter streamWriter = new StreamWriter(spAuthReq.GetRequestStream());
            streamWriter.Write(envelope);
            streamWriter.Close();
            HttpWebResponse response = spAuthReq.GetResponse() as HttpWebResponse;
            Cookie returnValue = response.Cookies[0];
            response.Close();
            return returnValue;

        }

      public Cookie  GetAuthCookieWin(String Url)
        {

          Cookie cookie=new Cookie();
          HttpWebRequest request = WebRequest.Create( 
                        Url + "_windows/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252FDefault%252Easpx&Source=%2FDefault.aspx") as HttpWebRequest;

                    // Provide a set of Windows credentials (default or explicit) 
                    request.Credentials = CredentialCache.DefaultNetworkCredentials; 
                    request.Method = "GET";  

                    // Assign the CookieContainer object 
                    CookieContainer cookies = new CookieContainer();  
                     request.CookieContainer = cookies; 
                    request.AllowAutoRedirect = false; 

                    // Execute the HTTP request 
                    HttpWebResponse response = request.GetResponse() as HttpWebResponse; 
                    if (null != response) 
                    { 
                        // The following variable simply holds the FedAuth cookie value, but that value 
                        // is not used directly 
                        cookie = response.Cookies["FedAuth"]; 
                    }
                    return cookie;

        }
    }
}

I hope the attached code will be usefull. But you may turn this in to jquery call.

2
  • I think this think is incorrect. I am working on a similar project and if I attempt to hit Authentication.asmx for a claims based site then I get an error message :Site is not configured for Claims-based authentication Dec 2 '16 at 11:01
  • double check whether you have choosed claims based auth while creating the web app. you might be having it as classic mode.
    – kesava
    Dec 5 '16 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.