Directory Programming .NET

Active Directory and ADAM programming support for .NET developers
Welcome to Directory Programming .NET Sign in | Join | Help
in Search

ADFS return url

Last post 01-20-2010, 5:33 PM by joe. 1 replies.
Sort Posts: Previous Next
  •  01-19-2010, 2:20 PM 7734

    ADFS return url

    I have a Silverlight 3 application which is using ADFS for authentication. This is all configured & working correctly in our live environment. Anonymous access is not enabled on the website.

    The Silverlight application is using the Navigation Framework - this produces urls in the following format:
    https://domainname/default.aspx#community

    However, if a user types this URL directly into the browser, they are redirected to the login page. Once successfully logged in the user is redirected back to https://domainname/default.aspx. Everything from the # is dropped.

    Is it possible for ADFS to retain the entire url (including the # values) when users are signing in. Or is this not possible because web servers do not receive the # values when requesting the URL.

    Thanks
  •  01-20-2010, 5:33 PM 7736 in reply to 7734

    Re: ADFS return url

    Interesting you should mention this as I've been having this discussion at work on a similar topic just recently. :)

    The problem is that the URL bookmark character, the # sign, is NOT sent by the client to the server when it submits a GET or POST request. The browser remembers that client side and adds it back in as needed, but it is never sent to the server.

    Any forms-based authentication method relies on a URL retention mechanism to return you to the URL you requested after you login. However, because this part of the URL is never sent to the server at all in the GET request, the ADFS agent cannot retain it and thus it is not "there" when you are redirected back. This is what you are seeing.

    The only solution is to ensure that you use URLs that ARE fully sent to the server, at least during the initial request where you will be authenticated. A query string might work instead. However, it will be up to you to figure out how to deal with this. You might not be able to use the navigation framework you are using now or you might need to implement some type of a workaround. However, you can't fix this on the ADFS side or with any other forms-based auth mechanism because the server simply never sees this in the request.

    I hope this doesn't turn out to be too disruptive for you.

View as RSS news feed in XML