We have successfully created an MVC/Angular application integrated with ADFS. Due to the Angular framework, a wrapper had to be developed around ADFS in order to capture the token and utilize it as a claim for access within angular.
The primary method responsible for this functionality is as follows:
public async override Task Invoke(IOwinContext context)
{
if (context.Request.Path.StartsWithSegments(new PathString(ConfigurationManager.AppSettings["AuthorizationCodeResponsePath"])))
{
var authorizationCode = context.Request.Query[ConfigurationManager.AppSettings["AuthorizationCodeResponseParameter"]];
var token = this.RequestToken(
this.Options.TokenEndpoint,
new Uri(this.Options.ApplicationUri, ConfigurationManager.AppSettings["AuthorizationCodeResponsePath"]),
this.Options.ClientId,
authorizationCode);
var principal = this.ValidateToken(token, this.Options.Audience, this.Options.Issuer, this.Options.Certificate);
this.AddTokenToPrincipal(principal, token);
this.SignIn(context.Authentication, principal);
context.Response.Redirect(this.Options.RedirectPath.Value);
}
else if (context.Request.Path.StartsWithSegments(new PathString(ConfigurationManager.AppSettings["SignOutPath"])))
{
if (context.Request.Query.Any(q => q.Key == "post_logout_redirect_uri"))
{
context.Response.Redirect(ConfigurationManager.AppSettings["ADFS"] + "/adfs/ls/?wa=wsignoutcleanup1.0");
}
else
{
this.SignOut(context.Authentication);
}
}
else
{
await this.Next.Invoke(context);
}
}
In essence, upon logging in, users are signed into ADFS which then redirects to a specific URL captured in the initial block of code. The authorization code is obtained from here to request a token, add a claim, and proceed with signing in.
The challenge arises during sign out. When the application triggers a sign out request, the URL is caught in the second block resulting in a sign out action redirecting to the ADFS page. Although the .AspNet.Federation cookie appears expired or removed, reloading the page prompts the application to request a new one. This functionality operates smoothly on Chrome/Firefox; however, in Internet Explorer, clearing cookies upfront enables successful sign out completion. Is there a missing element that should be considered?