Thinktecture Identity Server HRD for two Client APP and different Return URL - thinktecture-ident-server

I have followed this article Using IdSrv2 as IP-STS with membership store and can work fine on my first client App with returnurl: abc.com/a.aspx in one of the Relying Parties & Resources.
For my scenario I just want to create a Identity Provider I created. this is because I don't want to show all of the Idendity providers that I created in the HRD page just want to show my IDP and the other idnetity services from social network(facebook, google+, etc.) .
but I met it always return to the abc.com/a.aspx when I login to my second client app.is there any solution to solve my problem ?

I have created the setup that I believe you are trying to achieve. So I have Portal1 and Portal2. Both portals are set to authenticate users agains idsrv2 (thinktecture identityserver) and are set to use HRD. Idsrv2 is set to delegate authentication of users through HRD to idsrv (thinktecture identityserver).
The configuration of Portal1 web.config (only the important part) is
<system.identityModel>
<identityConfiguration>
<audienceUris>
<add value="https://localhost/Portal1/" />
</audienceUris>
<issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
<authority name="http://idsrv2">
<keys>
<add thumbprint="BCD339ECD62BC50DEDA3B54D2236D12AE1217687" />
</keys>
<validIssuers>
<add name="http://idsrv2" />
</validIssuers>
</authority>
</issuerNameRegistry>
<!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
<certificateValidation certificateValidationMode="None" />
</identityConfiguration>
</system.identityModel>
<system.identityModel.services>
<federationConfiguration>
<cookieHandler requireSsl="false" />
<wsFederation passiveRedirectEnabled="true" issuer="https://localhost/idsrv2/issue/hrd" realm="https://localhost/Portal1/" requireHttps="false" />
</federationConfiguration>
</system.identityModel.services>
And configuration of Portal2 (also important parts only) is:
<system.identityModel>
<identityConfiguration>
<audienceUris>
<add value="https://localhost/Portal2/" />
</audienceUris>
<issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
<authority name="http://idsrv2">
<keys>
<add thumbprint="BCD339ECD62BC50DEDA3B54D2236D12AE1217687" />
</keys>
<validIssuers>
<add name="http://idsrv2" />
</validIssuers>
</authority>
</issuerNameRegistry>
<!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
<certificateValidation certificateValidationMode="None" />
</identityConfiguration>
</system.identityModel>
<system.identityModel.services>
<federationConfiguration>
<cookieHandler requireSsl="false" />
<wsFederation passiveRedirectEnabled="true" issuer="https://localhost/idsrv2/issue/hrd" realm="https://localhost/Portal2/" requireHttps="false" />
</federationConfiguration>
</system.identityModel.services>
Now, configuration of idsrv (the parts I believe are important):
And finally the configuration of idsrv2:
And last the network flow when authenticating on Portal1

Related

Are rewrite providers supported inside ASP.NET core?

I know you can have rewrite middleware but I have my database where all rewrite rules are set up and I use this code that used to work inside .net framework. Is this supported in .NET core. What is solution?
<rewrite>
<providers>
<provider name="FileMap" type="DbProvider, Microsoft.Web.Iis.Rewrite.Providers, Version=7.1.761.0, Culture=neutral, PublicKeyToken=0545b0627da60a5f">
<settings>
<add key="ConnectionString" value="myconnString" />
<add key="StoredProcedure" value="Search.GetRewriteUrlMvc" />
<add key="CacheMinutesInterval" value="0" />
</settings>
</provider>
</providers>
<!--<rules configSource="rewrite-rules-sol-local.config" />-->
<rewriteMaps configSource="rewritemaps-sol.config" />
</rewrite>

Losing WIF Claim with load balanced server

I have an MVC4 C# project that uses WIF authentication. I am having a problem on a server with load balancing.
I am getting an error accessing one of the claims when the server behind the load balancer changes.
This is strange because I do not lose that fact that I am authenticated. That indicates that my cookie is getting to the new server but the claim is missing for some reason.
I am adding a claim like this:
((ClaimsIdentity)HttpContext.User.Identity).AddClaim(new Claim("TheClaimName", "TheClaimValue"));
I think that perhaps the claim itself is not being persisted to the cookie. How do I 'save' this?
Here is my config file.
<system.identityModel>
<identityConfiguration>
<audienceUris>
<add value="uri:someValue" />
</audienceUris>
<certificateValidation certificateValidationMode="None" />
<issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">
<trustedIssuers>
<add thumbprint="AAAA3A088B9D2010333890138D64C2E66169DEEE" />
</trustedIssuers>
</issuerNameRegistry>
<securityTokenHandlers>
<add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
<remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
</securityTokenHandlers>
</identityConfiguration>
</system.identityModel>
<system.identityModel.services>
<federationConfiguration >
<cookieHandler requireSsl="true" name=".myCookieName" hideFromScript="true" path="/" domain="myDomain.com"/>
<wsFederation passiveRedirectEnabled="true" issuer="https://login.server.com/issue/wsfed" realm="uri:someValue" requireHttps="true" />
</federationConfiguration>
</system.identityModel.services>

imageresizer remote reader plugin only displays the remote image if no query strings are present in URL

I'm trying to resize/crop the images stored on one of our servers and use them on another, also our server. Image resizer is running on www.aapg.org. Remote images are stored on assets.aapg.org.
Not sure why it doesn't work. I followed the process outlined in http://imageresizing.net/plugins/remotereader -- everything looks OK. I tried both a signed remote URL and human-friendly syntax, and neither worked for me.
Here are the plugins from the Web.config file I'm using:
<add name="MvcRoutingShim" />
<add name="DiskCache" />
<add name="SeamCarving" />
<add name="SimpleFilters" />
<add name="PdfRenderer" downloadNativeDependencies="true" />
<add name="DropShadow" />
<add name="WhitespaceTrimmer" />
<add name="PrettyGifs" />
<add name="AnimatedGifs" />
<add name="WebPEncoder" />
<add name="WebPDecoder" />
<add name="RemoteReader" />
<add name="CloudFront" />
And the remote reader plugin configuration ('xxxxxxxxxxxxxxxxxxxxxx' is obviously not what I'm using):
<remotereader signingKey="xxxxxxxxxxxxxxxxxxxxxx" allowAllSignedRequests="false" allowRedirects="5">
<allow domain="aapg.org" />
<allow domain="assets.aapg.org" />
</remotereader>
Can anyone tell me what I'm doing wrong? Or what I'm missing?
Thanks in advance!

MVC4 Intranet site IIS 7, cannot display the webpage

I have been at this for hours and still have not figure out what I am doing wrong. I created an MVC4 intranet site and now I am ready to deploy it to IIS on our web server. I setup a site called Portal and from Visual Studio I have performed the 1 click publish using the file system method. The files copied successfully to my site. In IIS I changed authentication to Windows and disabled Anonymous authentication. I even went into my application pool and changed the Load User Profile = true (not sure if I needed to do that). I then hit browse Portal on *:88 and I receive Internet Explorer cannot display the webpage. I checked my Modules and I see UrlRoutingModule-4.0 is managed and inherited. I must be overlooking an obvious setting as this is my first web site. Any help is appreciated. Thank you.
physical path = c:\inetpub\wwwroot\Portal
Site name and Application Pool = Portal (.Net 4 and Pipeline mode: integrated)
type = http
Host name = Portal
Port = 88 (80 was already used and did not work)
IP Address = *
UPDATE: Webconfig (i have custom roles) and Routconfig
<system.web>
<roleManager enabled="true" defaultProvider="DbRoleProvider">
<providers>
<clear />
<add name="DbRoleProvider"
applicationName="Portal"
type="Portal.WebUI.Infrastructure.DbRoleProvider"
connectionStringName="PortalEntities" />
</providers>
</roleManager>
<compilation debug="true" targetFramework="4.0" />
<authentication mode="Windows" />
<authorization>
<deny users="?" />
</authorization>
<pages>
<namespaces>
<add namespace="System.Web.Helpers" />
<add namespace="System.Web.Mvc" />
<add namespace="System.Web.Mvc.Ajax" />
<add namespace="System.Web.Mvc.Html" />
<add namespace="System.Web.Optimization" />
<add namespace="System.Web.Routing" />
<add namespace="System.Web.WebPages" />
</namespaces>
</pages>
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<modules runAllManagedModulesForAllRequests="true" />
<handlers>
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers></system.webServer>
public static void RegisterRoutes(RouteCollection routes)
{
routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
routes.MapRoute(
name: "Default",
url: "{controller}/{action}/{id}",
defaults: new { controller = "RequestInfo", action = "Index", id = UrlParameter.Optional }
);
}
so after more experimentation and research I found my problem, and it was a result of never doing this before.
My first problem was I included a host name when I was setting up my application. So when I tried to browse to www.portal.com:85 on the server it did not understand that address and could not connect to anything. However, when I removed the host name and typed in http://localhost:85 it worked. I will have to get with my infrastructure team to set that up.
My second problem was security to our SQL Server. I did not know I had to setup a login for the application pool name. I used the second answer from this post Login failed for user 'IIS APPPOOL\ASP.NET v4.0' because I did not want to change the identity to LocalSystem. Once I setup a login under the SQL Server security the site was functioning. Is that the correct way of doing it?
It would be helpful if you disabled friendly error messages in IE. In "Internet Options" on the Advanced tab, under Browsing deselect "Show friendly HTTP error messages". Then try again. Hopefully then you'll see what the actual issue is as an HTTP status code. Can it not find the server, are you getting a 404 (page not found), a 401 unauthorized, a 500, etc.
With that information it will be much easier to diagnose.

Configure Memcache with Castle ActiveRecord?

Anyone know how to configure an ActiveRecord/nhibernate application to use Memcache as the 2nd level cache?
Start with the ActiveRecord docs on second level cache configuration. Then, for specific information about Memcached, see this question.
You'll end up with a config similar to this:
<activerecord>
<config>
<add key="connection.driver_class" value="NHibernate.Driver.SqlClientDriver" />
<add key="dialect" value="NHibernate.Dialect.MsSql2005Dialect" />
<add key="connection.provider" value="NHibernate.Connection.DriverConnectionProvider" />
<add key="connection.connection_string" value="Data Source=.;Initial Catalog=test;Integrated Security=SSPI" />
<add key="cache.provider_class" value="NHibernate.Caches.MemCache.MemCacheProvider, NHibernate.Caches.MemCache"/>
<add key="cache.use_second_level_cache" value="true"/>
<add key="cache.use_query_cache" value="true"/>
</config>
</activerecord>