c# - net asp authentication claims Error - A SignInResponse message may only redirect within the current web application - MVC 2.0 application



2 Answers

I override the RedirectToIdentityProvider on subclass of WSFederationAuthenticationModule. This happens only once before redirecting to the STS. You have to tell the config file to use this class FixedWSFederationAuthenticationModule instead of the defualt WSFederationAuthenticationModule

public class FixedWSFederationAuthenticationModule : WSFederationAuthenticationModule
{
    public override void RedirectToIdentityProvider(string uniqueId, string returnUrl, bool persist)
    {
        //This corrects WIF error ID3206 "A SignInResponse message may only redirect within the current web application:"
        //First Check if the request url doesn't end with a "/"
        if (!returnUrl.EndsWith("/"))
        {
            //Compare if Request Url +"/" is equal to the Realm, so only root access is corrected
            //https://localhost/AppName plus "/" is equal to https://localhost/AppName/
            //This is to avoid MVC urls
            if (String.Compare(System.Web.HttpContext.Current.Request.Url.AbsoluteUri + "/", base.Realm, StringComparison.InvariantCultureIgnoreCase) == 0)
            {
                //Add the trailing slash
                returnUrl += "/";
            }
        }
        base.RedirectToIdentityProvider(uniqueId, returnUrl, persist);
    }
}
windows identity foundation asp net

I have a situation where we have a MVC 2 application(I tried this with a basic MVC 2 app without any extra stuff, still same problem) and am using adfs 2 for authenticating my users.

So.. Now I get into my application and I get the below.. ID3206: A SignInResponse message may only redirect within the current web application: '/[app]' is not allowed. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: Microsoft.IdentityModel.Protocols.FederationException: ID3206: A SignInResponse message may only redirect within the current web application: '/[app]' is not allowed.

I have read most blogs on this, and posted to one..

    <federatedAuthentication>
            <wsFederation passiveRedirectEnabled="true" issuer="https://auth.[domain]/adfs/ls/" realm="https://[development domain]/[app]/" requireHttps="true" />
            <cookieHandler requireSsl="true" />
          </federatedAuthentication>
<audienceUris>
    <add value="https://[development domain]/[app]/" />
  </audienceUris>
  1. I have the trailing slash on the realm and audienceUris.
  2. I have added what he suggested to Application_BeginRequest – I then copied code to [development domain] as that’s where the certs are.. It just gets stuck in an infinite loop then.
  3. I also have checked my Relying Party on the Geneva server.. The Identifiers and Endpoints(POST) are both https://[development domain]/[app]/ - again with the trailing slash

I think it’s a problem with the fact it’s a MVC application, I have created numerous Claims Aware website and got my claims etc on the default.aspx page. My thinking is that the routing that is involved with the MVC app is somehow posting it back wrong?

any help really apprecaited as Im looking at this for quiet a while now to no avail..

J




I'm using Forms authentication with WIF. The forms auth module redirects unauthorized requests to the correct controller and stores the originally requested URL in the ReturnUrl parameter, so I worked around this bug by overriding the GetReturnUrlFromResponse method.

/// <summary>
/// Provides a workaround for a bug in the standard authentication module.
/// </summary>
/// <remarks>
/// This class corrects WIF error ID3206 "A SignInResponse message may only
/// redirect within the current web application..."
/// WSFAM produces the error when the ReturnUrl is the root of the web application,
/// but doesn't have a trailing slash. For instance, "/app" is considered incorrect
/// by WSFAM whereas "/app/" is correct.
/// </remarks>
public class FixedWsFederationAuthenticationModule : System.IdentityModel.Services.WSFederationAuthenticationModule
{
    /// <summary>
    /// Extracts the URL of the page that was originally requested from
    /// the sign-in response.
    /// </summary>
    /// <returns>
    /// The URL of the page that was originally requested by the client.
    /// This is the URL (at the relying party) to which the client should
    /// be redirected following successful sign-in.
    /// </returns>
    /// <param name="request">
    /// The HTTP request that contains a form POST, which contains the
    /// WS-Federation sign-in response message.
    /// </param>
    protected override string GetReturnUrlFromResponse(HttpRequestBase request)
    {
        string returnUrl = base.GetReturnUrlFromResponse(request);

        // First Check if the request url doesn't end with a "/"
        if (!string.IsNullOrEmpty(returnUrl) && !returnUrl.EndsWith("/"))
        {
            // Compare if (return Url +"/") is equal to the Realm path,
            // so only root access is corrected.
            // /AppName plus "/" is equal to /AppName/
            // This is to avoid MVC urls.
            if (string.Compare(
                returnUrl + "/",
                new Uri(Realm).LocalPath,
                StringComparison.InvariantCultureIgnoreCase) == 0)
            {
                // Add the trailing slash.
                returnUrl += "/";
            }
        }

        return returnUrl;
    }
}

To make use of this class, you need to register it in the web.config. Add this element to the system.webServer/modules section, changing the appropriate parts:

<add name="WSFederationAuthenticationModule" type="YOUR_NAMESPACE.FixedWsFederationAuthenticationModule, YOUR_ASSEMBLY" preCondition="managedHandler" />



Related