IdentityServer4 with ADFS as external Identity Provider

Question

I'm having a ASP.NET MVC test app who should work as an implicit OIDC client having access and id tokens from an IdentityServer4 app (both are dotnet core 3.1). IdSvr has a couple of external OIDC IdPs configured: A KeyCloak instance, and a ADFS (4.0) ditto.

My IdSvr configuration of ADFS is as follows:

.AddOpenIdConnect("oidc_adfs", "ADFS", options =>
{
    options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
    options.SignOutScheme = IdentityServerConstants.SignoutScheme;
    options.SaveTokens = true;

    options.Authority = "<<ADFS endpoint>>";
    options.ClientId = "<<ADFS defined client id>>";
    options.ClientSecret = "<<ADFS defined client secret>>";
    options.Resource = "<<My resource identifier in ADFS>>";

    options.TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = "name",
        RoleClaimType = "role"
    };

    options.ResponseType = "id_token";
    options.GetClaimsFromUserInfoEndpoint = true;

    options.Scope.Add("openid");
    options.Scope.Add("profile");
});

In the KeyCloak case, everything goes fine - the callback request to IdSvr's "/signin-oidc" goes fine and the front-channel user agent ends at the destination test app's post-auth endpoint and the tokens are available. When I use ADFS, the flow stops with a HTTP 500 after the user is authenticated in ADFS, and the "/signin-oidc" endpoint is hit, and IdSvr log reads:

CORS request made for path: /signin-oidc from origin: <<ADFS_endpoint>> but was ignored because path was not for an allowed IdentityServer CORS endpoint 2020-09-20 12:34:01.157 +02:00 [INF] Error from RemoteAuthentication: Unable to unprotect the message.State..

I've setup CORS according to the IdentityServer4 docs, so the problem might be something else?

When inspecting differences in KeyCloak and ADFS callback requests to "/signin-oicd", I can see that ADFS does add Referer/Origin to the request and KeyCloak does not. Apart from that, the two requests seem quite similar.

Hope someone can help.

Answer 1

If you see the Origin header from ADFS, then I guess you need to add the ADFS domain to the list of allowed CORS endpoints.

Answer 2

What error is shown in the ADFS event log?

The problem may also be that ADFS 4.0 does not support CORS?