ADAL ADFS + SharePoint

[Alexander Adelmann]

Hi everyone,

I have the following task: Connect to a SharePoint 2016 Site which is Secured by ADFS using an Angular Client.

The parties I have are: 

* Angular JS Client Application using ADAL

* WCF Middleware also using AuthenticationContext

* ADFS on Server 2016

* SharePoint 2016 Server

The flow of my setup is as follows:

1) The user opens a site. He gets redirected to ADFS and enters his credentials

2) I get a token back from ADFS which looks good. Audience is a Native App which I configured on ADFS. I also have no errors in the Event log on the ADSF Server

3) The Angular App Calls my WCF API and sends the token

4) The WCF creates a User Assertion Object and trys to obtain a token to access SharePoint using Clientcontext

----- Error happens here------

5) I should get back another token valid for access SharePoint

6) I use clientcontext to get data from the SP Site

7) SP returns the infos

8) The WCF sends the data to the client which displays it for the user

The Problem is that after step 4 I get one of these errors that says:

* AADSTS50013: Assertion contains an invalid signature. [Reason - The key was not found

* MSIS9605: The client is not allowed to access the requested resource

* MSIS9602: The received 'resource' parameter is invalid. The authorization server can not find a registered resource with the specified identifier

In the ADFS Management Console I created a Application Group. In this group I have a Server Application where I specified ClientID and redirect Uri. These settings are used in the Angular App.

I also have a Web API Application in the group. There I configured my IIS Site and SharePoint Site as Relying party identifiers.

I obviously don't fully understand the connection of my Applications to the SharePoint. 

Can anybody help me out here?

Thx 

Alex

[#2 · Accepted solution]

Ok, so just for closure:

I did not get the setup running like I wanted it to. I still do not know if the flow with ADFS involved can be done the way I tried it.

So here is how I managed to solve my problem anyway:

Client:

I used an AzureAPP du get an Id token of the current user, which I parsed to get the AzureAD loginname of that user.

Server:

I used the OfficeDevPnP.Core.AuthenticationManager to call the GetADFSUserNameMixedAuthenticatedContext function and did everything within the context of the provided (elevated) user. I then did the Security Trimming myself, by checking if the current user (see client) has the needed permissions on a specific list Item for example. 

This is not very fast I guess, as I have to loop through all List Items I get (because I am running the code as Admin) and then check each one for the permissions and sort it out, if the user should not be allowed to see it.

I am not really happy with the solution I finally came up with, but that was the solution I was able to implement after many days of research, anger, tears, questioning life...

So in case somebody else has the same problem: If you find a proper solution, please contact me. If not, feel free to use the same workaround as I did.

regards

Alex