7

I'm trying to set up our Angular SPA + .ASPNET Core API with ADFS (on premises) to get rid of windows authentication. Ultimately the goal would be:

  • Angular SPA - > Redirects user to ADFS and receives id_token back
  • Angular SPA - > Uses this token to call API
  • Angular SPA - > Refreshes the token from time to time

The Angular SPA and API are correctly configured on ADFS. I'm using angular-oauth2-oidc to configure the spa.

The issue is: when loading the SPA I get a CORS error when the SPA tries to reach the OpenId Discovery endpoint (.well-known/openid-configuration). So I cannot even redirect the user to ADFS. Nothing works.

I looked a lot online and only found lots of other people saying that ADFS doesn't support CORS. Seems strange though. Microsoft claims that they support Single Page Applications, so you already more or less assume that ADFS will be receiving CORS requests.

Has anyone else bumped into this issue? Seriously that Microsoft had implemented this and didn't built in a way to allow CORS requests?

Edit: I also tried creating a wrapper around adal.js. I managed redirecting the user to ADFS, logging in and get the id_token. The issue now is that the sts returns the aud claim for the spa in the token, not for the api. When SPA uses the token to call the API it as expected fails. Feels like I have hit a dead end on this.

jpgrassi
  • 5,482
  • 2
  • 36
  • 55
  • Hi, I'm hitting exactly the same dead end, did you finally found a solution for this issue ? – Binary9 Oct 01 '18 at 08:56
  • More or less.. I managed to make it work using adaljs. It's a long time ago.. and I don't work on it anymore so.. can't share much details :(. But you can search for angular adal package, pretty sure it's one of the first results. – jpgrassi Oct 01 '18 at 08:59

1 Answers1

3

Not possible in ADFS 2016, not solved in ADFS 2018 (So far).

https://social.technet.microsoft.com/Forums/en-US/efcb35b3-f0f6-4c83-8a34-8e939aa56e7f/adding-cors-headers-to-oidc-discovery-endpoint-in-adfs-2016?forum=ADFS

Jeff

Jeff LOMBARDO
  • 324
  • 1
  • 11
  • Solved in 2019, untested as I'm stuck on 2016 https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs – Jeff Feb 24 '20 at 19:21