ASP.NET Core with multiple authorization providers - asp.net-core

Question

I have a small web application to build on ASP.NET Core and it has both an UI and an API for external consumption.
I have some restrictions in terms of infrastruture so this would be hosted as a single app service in Azure if possible.
The thing is that the UI part must authenticate to an authentication provider with SAML, and the API part must authenticate/authorize with bearer tokens from Identity server.
My question is if this is possible under the same service, or if it is really necessary to have one project to the UI and other to the API?

Answer 1

ASP.NET Core supports multiple authentication handlers within the one application. The handlers are added through the builder.Services.AddAuthentication method.
If you're using IdentityServer4, it doesn't include native support for SAML SSO so you'll need to use something like the ComponentSpace SAML authentication handler. The following code adds support for SAML into IdentityServer4.
// Add SAML SSO services.
builder.Services.AddSaml(builder.Configuration.GetSection("SAML"));
// Add SAML authentication services.
builder.Services.AddAuthentication().AddSaml(options =>
{
options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
options.SignOutScheme= IdentityServerConstants.ExternalCookieAuthenticationScheme;
});
IdentityServer4 will delegate the SAML SSO to the SAML authentication handler which in turn will SSO to some external identity provider. IdentityServer4 will handle the issuance of bearer tokens.
This assumes that authentication has been delegated to IdentityServer4. Alternatively, you could handle the SAML SSO from within your application but it would be more involved to then have IdentityServer4 handle the issuance of bearer tokens.