Sample HTTPClient code to authenticate against Embedded STS - thinktecture-ident-server

Question

We are using Embedded STS locally to test our ASP.Net web application. I'm creating a console app to call some of the WebAPI methods and to do some load testing on our app. I'd like to test using a set of users with certain permissions. For our local instance, that means authenticating against EmbeddedSTS.
How do I write an HttpClient to authenticate against EmbeddedSTS to receive this token and auth against my WebAPI endpoints?
Edit: bonus points if I can get the SAML Token while running the app in HTTP mode (not HTTPS).

Answer 1

I figured out how to do this.
Caveat: this is just used for a one off console app that lets us auth against EmbeddedSTS and do the WebAPI calls for stress testing purposes.
Essentially, we simulate what would happen on the browser. This uses the HttpClient and HtmlAgilityPack to parse through the HTML responses, select a user, POST it back to EmbeddedSTS, then POSTs the WS Fed token result and finally receives the FedAuth cookies. After that, the HTTP Client can be used to call any WebAPI or MVC pages in the app.
public static Task<HttpClient> BuildClient(string authurl, string username)
{
var task = Task.Run<HttpClient>(async () =>
{
// setup http client an cookie handler
var handler = new HttpClientHandler();
handler.AllowAutoRedirect = true;
handler.CookieContainer = new System.Net.CookieContainer();
handler.UseCookies = true;
var client = new HttpClient(handler);
client.MaxResponseContentBufferSize = 256000;
client.DefaultRequestHeaders.Add("User-Agent", "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)");
client.DefaultRequestHeaders.Add("Connection", "Keep-Alive");
client.DefaultRequestHeaders.ExpectContinue = false;
// this is the html of the page that has the user dropdown
var userSelectionPage = await client.GetStringAsync(authurl);
string actionPathAndQuery = GetAction(userSelectionPage);
// for the purposes of this sample, we just choose the user called admin
var postData = new List<KeyValuePair<string, string>>() {
new KeyValuePair<string, string>("username", username)
};
// now we post the user name and expect to get the ws fed response
var wsfedresponse = await client.PostAsync(authurl + actionPathAndQuery, new FormUrlEncodedContent(postData));
var wsfedcontent = await wsfedresponse.Content.ReadAsStringAsync();
var namevaluepairs = GetHiddenInputNameValues(wsfedcontent);
var finalpost = await client.PostAsync(authurl, new FormUrlEncodedContent(namevaluepairs));
// at this point, the fedauth cookie is set, we are good to go
return client;
});
return task;
}
private static string GetAction(string htmlContent)
{
var d = new HtmlDocument();
d.LoadHtml(htmlContent);
var node = d.DocumentNode.SelectSingleNode("//form[#action]");
var result = node.GetAttributeValue("action", string.Empty);
return result;
}
private static IEnumerable<KeyValuePair<string, string>> GetHiddenInputNameValues(string htmlContent)
{
var d = new HtmlDocument();
d.LoadHtml(htmlContent);
var nodes = d.DocumentNode.SelectNodes("//input[#type='hidden']");
return nodes.Select(p =>
new KeyValuePair<string, string>(
p.GetAttributeValue("name", string.Empty),
System.Web.HttpUtility.HtmlDecode(p.GetAttributeValue("value", string.Empty))
));
}

Answer 2

EmbeddedSts does ws-federation. This is not designed for web Apis. You rather want Oauth2.