{"id":2348,"date":"2013-07-30T13:59:15","date_gmt":"2013-07-30T20:59:15","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=2348"},"modified":"2013-07-31T08:07:07","modified_gmt":"2013-07-31T15:07:07","slug":"securing-a-web-api-with-windows-server-2012-r2-adfs-and-katana","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2013\/07\/30\/securing-a-web-api-with-windows-server-2012-r2-adfs-and-katana\/","title":{"rendered":"Securing a Web API with Windows Server 2012 R2 ADFS and Katana"},"content":{"rendered":"

Last week I wrote a post<\/a> about how to use Katana<\/a> and Windows Azure AD to secure an MVC4 Web API, and showed how to use AAL to build a Windows Store client in just few lines of code.
This week I\u2019d like to show you how you can apply the exact same approach when using the new OAuth2 & JWT support in Windows Server 2012 R2 ADFS<\/u><\/strong>; once again, this was one of the most frequent requests after my \/\/BUILD\/ session<\/a> last month hence I hope this will make you guys happy \"Smile\". <\/p>\n

Note: I am writing this post mostly for unblocking some people who asked for help right now, and for demonstrating the use of Katana in Web API scenarios a where the directory is kept on-premises. The ADFS guys will publish lots of official documentation in the coming weeks\/months, and it goes without saying that you should always refer to the official documentation. <\/p>\n

Walkthrough<\/h2>\n

The scenario we want to implement is pretty simple: we want to restrict access to an MVC4 Web API to the users of a given on-premises AD instance, which happens to be using Windows Server 2012 R2 ADFS (just \u201cADFS\u201d from now on). Furthermore, we want to expose the Web API to the user via a Windows Store application.<\/p>\n

This is the exact same scenario we discussed last week<\/a>, and the implementation is nearly the same; hence instead of writing the same things I am going to ask you to read last weeks\u2019 post<\/a> first. Once you have done that, and you have working bits in Visual Studio, you can come back here and I\u2019ll show you how to modify things to make the ADFS scenario work.
Another prerequisite is that you must have a Windows Server 2012 R2 ADFS instance available: you can download the Preview here<\/a>.<\/p>\n

Setting Up the Web API Project<\/h3>\n

Alrighty, do you have the Windows Azure AD based scenario working? Fantastic. Let\u2019s start to modify things to work with ADFS starting form the Web API project.<\/p>\n

The good news is that in a short you will not have to change any code at all in order to switch from Windows Azure AD to ADFS and vice versa: Katana will include middleware that will work with both. The bad news is that today the middleware we used for validating incoming tokens is hardwired to Windows Azure AD. However do not despair, as working around it is pretty straightforward.<\/p>\n

Modify your Startup.cs class as following:<\/p>\n

public<\/span> class<\/span> Startup\r\n{\r\n    public<\/span> void<\/span> Configuration(IAppBuilder app)\r\n    {\r\n        app.UseWindowsAzureBearerToken(new<\/span> WindowsAzureJwtBearerAuthenticationOptions()\r\n        {\r\n            Audience = \"https:\/\/contoso100.com\/API\/KatanaADFS_WebAPISample\"<\/span>,\r\n            Tenant = \"sts.contoso100.com\"<\/span>,\r\n            MetadataResolver = new<\/span> ADFSMetadataResolver()\r\n        });\r\n    }\r\n}\r\n<\/pre>\n