ShibbolethLogin 1.0.0

ShibbolethLogin

Shibboleth login library which can be used for single sign-on. It allows also use Active Directory.

Configuration

After adding this library to your project, it is neccesary to make settings in your Startup.cs file.

There is example of ConfigureServices method.

 public void ConfigureServices(IServiceCollection services)
        {
            var shibbolethClaims = new List<ClaimValuePair>() { new ClaimValuePair(ClaimTypes.GivenName, "cn") };
            var adClaims = new List<ClaimValuePair>() { new ClaimValuePair(ClaimTypes.Email, "mail") };

            services.AddSingleton<IClaimsConfig, ClaimsConfig>();
            services.AddSingleton<IRoleResolver>(new JsonConfigRoleResolver(Path.Combine(WebHostEnvironment.WebRootPath, "roles.json")));
            services.AddSingleton<IADConfig>(new ADConfig(Configuration["AD:Server"], Configuration["AD:Container"], Configuration["AD:User"], Configuration["AD:Password"], adClaims));
            services.AddSingleton<IShibbolethConfig>(new ShibbolethConfig(Configuration["Shibboleth:LoginUrl"], Configuration["Shibboleth:LogoutUrl"], Configuration["Shibboleth:AfterLoginPath"], shibbolethClaims, true, true, Configuration["Shibboleth:Testing"] == "true"));
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(options =>
                {
                    options.Cookie.Name = "ShibbolethLogin";
                    options.Cookie.HttpOnly = true;
                    options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
                    options.LoginPath = "/Account/Login";
                    options.LogoutPath = "/Account/LogOut";
                });

            services.AddSession(options =>
            {
                options.IdleTimeout = TimeSpan.FromMinutes(30);
                options.Cookie.HttpOnly = true;
            });

            services.AddControllersWithViews();
        }

You can specify which informations from Shibboleth or AD will be in claims. This line:

var shibbolethClaims = new List<ClaimValuePair>() { new ClaimValuePair(ClaimTypes.GivenName, "cn") };

Defines that claim name will be GivenName and "cn" will be value from Shibboleth headers. This list of claims you can pass by parameter in new ShibboletConfig service.

If you add this line of code services.AddSingleton<IClaimsConfig, ClaimsConfig>(); you have to create ClaimsConfig file which inherites from interface IClaimsConfig and implement method EditClaims(ClaimsIdentity claims, HttpContext context) where you can add your custom claims or do whatever you want.

If you want to use roles from file, you can add line services.AddSingleton<IRoleResolver>(new JsonConfigRoleResolver(Path.Combine(WebHostEnvironment.WebRootPath, "roles.json")));. The roles.json file structure is as follows

[
  {
    "Name": "superadmin",
    "Users": ["user123", "user234"],
    "ADGroups": [ ],
    "ChildRoles": [ ]
  },
  {
    "Name": "employee",
    "Users": [],
    "ADGroups": [ "zamestnanec" ],
    "ChildRoles": [ ]
  },
  {
    "Name": "student",
    "Users": [ ],
    "ADGroups": [ "student" ],
    "ChildRoles": [ ]
  }
]

If you will be use Active Directory then it get user roles from AD by ADGroups array. So if you want to user Active Directory, you have to register IADConfig service.

Always it is neccesary to register IShibbolethConfig service! There you will specify login url, logout url, claims, if you will be using Active Directory etc.

The next step is add the following code:

            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(options =>
                {
                    options.Cookie.Name = "ShibbolethLogin";
                    options.Cookie.HttpOnly = true;
                    options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
                    options.LoginPath = "/Account/Login";
                    options.LogoutPath = "/Account/LogOut";
                });

            services.AddSession(options =>
            {
                options.IdleTimeout = TimeSpan.FromMinutes(30);
                options.Cookie.HttpOnly = true;
            });

There you can set your Cookie name and expire time. LoginPath and LogoutPath must be always as in this example!

The last important step is add this three lines to Configure method.

            app.UseAuthentication();
            app.UseAuthorization();
            app.UseSession();