Question

I am using ACS to authenticate in a Windows 8 application. I am observing exactly what I expect in that the UI displays the authentication dialog and on successfully entering my LiveID credentials I am returned to my code with a Success status but I do not receive a security token, I simply get “https://XXXXX.accesscontrol.windows.net/v2/wsfederation?wa=wsignin1.0” in result.ResponseData

The code is as follows:

  string loginUriString = "https://XXXXX.accesscontrol.windows.net:443/v2/wsfederation?wa=wsignin1.0&wtrealm=http%2f%YYYYY.cloudapp.net";
    string redirectUriSting = "https://XXXXX.accesscontrol.windows.net:443/v2/wsfederation";

    string authToken;
    bool IsAuthenticated = false;

    private async Task AuthenticateAsync()
    {           
        var requestUri = new Uri(loginUriString, UriKind.RelativeOrAbsolute);

        var redirectUri = new Uri(redirectUriSting, UriKind.RelativeOrAbsolute);

        //var testUri = WebAuthenticationBroker.GetCurrentApplicationCallbackUri();

        var result = await WebAuthenticationBroker.AuthenticateAsync(
            WebAuthenticationOptions.None,
            requestUri,
            redirectUri);

        if (result.ResponseStatus != WebAuthenticationStatus.Success)
            throw new Exception(string.Format("Login failed : {0}", result.ResponseErrorDetail));

        //authToken = ExtractTokenFromResponse(result.ResponseData);

        //if (!string.IsNullOrEmpty(authToken))
        //{
        _client.DefaultRequestHeaders.Authorization =
            new System.Net.Http.Headers.AuthenticationHeaderValue("OAuth", result.ResponseData);

        IsAuthenticated = true;
        //}
    }

I have seen one other SO question here with what seems like a similar problem but nothing else. Have I got something wrong?

Answer 1

The WebAuthenticationBroker simply keeps browsing until the next requested page is the one specified by the callbackUri parameter. At that point it returns the final URL to you so if you want to get anything back it needs to be encoded in that URL.

In the ACS control panel for the relying party you need to specify a return url that is somewhere on your site. For example https://YYYYY.cloudapp.net/federationcallback. Then create a controller to handle accept a post to that URL. The post will have a form field wresult which is some xml that will contain the token returned from ACS.

You can then send the token back to the WebAuthenticationBroker by redirecting to https://YYYYY.cloudapp.net/federationcallback/end?token={whatever you want to return}

You would then need to change the usage of the authentication broker to the following:

var webAuthenticationResult = await WebAuthenticationBroker.AuthenticateAsync(
            WebAuthenticationOptions.None,
            new Uri("https://XXXXX.accesscontrol.windows.net:443/v2/wsfederation?wa=wsignin1.0&wtrealm=http%3a%2f%2fYYYYY.cloudapp.net%2f"),
            new Uri("https://YYYYY.cloudapp.net/federationcallback/end")
        );

// The data you returned
var token = authenticateResult.ResponseData.Substring(authenticateResult.ResponseData.IndexOf("token=", StringComparison.Ordinal) + 6);