ADFS User users mapping to custom user in asp.net web app

Question

We have an ASP.NET (4.5) web app using Forms authentication and custom database to authenticate users. Our client uses ADFS Active Directory Federation Services and would like to use ADFS users to log into our web app. I need to figure out how to map those ADFS users to our custom users in apps own database. When user attempts to access my app Login page they get re-directed to the ADFS login and once authenticated returned to my login page along with an object which would give access to some information about the authenticated user which I then need to map to the user in our web app. I'd really appreciate a simple code example which could be used with this scenario. Specifically need info on the user/principal object or something that's passed back and which I could use to uniquely identify a user and possibly a group the user belongs to than write my code to obtain the user from our database. I don't really want to make the web app ADFS aware, but I'm after something simple. That would work with this scenario.

Answer 1

You can make ADFS return an additional claim that will help to identity the user, e.g. email - see this answer for details. Once configured, use following code inside your controller to get email of the ADFS-authenticated user:

public static string GetAuthenticatedUserEmail()
{
    return ClaimsPrincipal.Current?.Identity?.IsAuthenticated ?? false
           ? ClaimsPrincipal.Current.Claims
             .SingleOrDefault(claim => claim.Type == ClaimTypes.Email)
             ?.Value
           : null;
}

Also you can verify the claim issuer by following config section:

<system.identityModel>
  <identityConfiguration>
    ...
    <certificateValidation certificateValidationMode="PeerOrChainTrust" />
    <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
      <authority name="http://your-adfs-domain.com/adfs/services/trust">
        <keys>
          <add thumbprint="the thumbprint" />
        </keys>
        <validIssuers>
          <add name="http://your-adfs-domain.com/adfs/services/trust" />
        </validIssuers>
      </authority>
    </issuerNameRegistry>
  </identityConfiguration>
</system.identityModel>
<system.identityModel.services>
  <federationConfiguration>
    <wsFederation issuer="https://your-adfs-domain.com/adfs/ls" realm="https://your-service-domain.com"
                  requireHttps="true" reply="https://your-service-domain/StartPage" passiveRedirectEnabled="true" />
    <serviceCertificate>
      <!-- The sertificate should have a private key -->
      <certificateReference x509FindType="FindBySubjectName" findValue="some subject" storeLocation="LocalMachine" storeName="My" />
    </serviceCertificate>
  </federationConfiguration>
</system.identityModel.services>

Finally you can map the user to your table by the retrieved email (or another claim).