Take the 2-minute tour ×

I am being tasked with writing an asp.net web app that will use ADFS for authentication. However, at one stage in the application users will have to re-authenticate and supply their username and password again.

Can this be done with ADFS?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

The ASP.NET app can be an active client to the STS as well as a passive one. When you need to step up, provide some input fields and ask the user for additional proof of who they are. Using the WSTrustChannelFactory, pass this info (and possibly the original token) to the STS to get a new token that is fresher and contains claims that are sufficient to authorize the the higher value transaction.

share|improve this answer
not sure if this will work, but I'll give it a shot. Thanks! –  Matthew Bonig Feb 11 '11 at 21:23
If you run into issues, let me know: J.mp/SPa –  Travis Spencer Feb 12 '11 at 8:11
How will this work if the RP/STS is different from the IP/STS? Then for this step-up scenario, the application would also need to know the IP/STS that was used in the passive sign-in, it looks like. How would one go about that? –  Marnix Klooster Apr 30 '11 at 17:47
Chain the active STSs together just like was done w/ the passive ones. In other words, get the username and PIN in the Web app, send them to the IP-STS. If they're valid, the IP-STS will issue a new token. Send that to the RP-STS. It will issue a second token which the app will be able to crack because it was emitted by the STS that it trust. Not sure I'd solve this problem that way, but it's food for thought at least. –  Travis Spencer Aug 31 '11 at 7:19

What is the goal of the re-authentication, i.e., what does the user need to prove?

I'm presuming the application wants a sign-in token with a recent authentication timestamp (within, say, the last 10 seconds), so that the application is reasonably sure that the client system is really still under that same user's control.

(Watch out for clock differences between your web server and your AD FS server, by the way.)

In the coming months I will be investigating a similar scenario, and my current idea is to use the SessionAuthenticationModule.SessionSecurityTokenReceived Event, as described in this blog post by Vittorio Bertocci. However, that cannot be the entire solution, since this only forces AD FS to give out a token, but it does not force AD FS to give out a token with a recent authentication timestamp.

So no answer yet, but perhaps these hints help.

share|improve this answer
Yes, this is precisely what I want. The application will be SSO but when getting into more "secure" locations of the app I want to re-verify the user account. –  Matthew Bonig Feb 9 '11 at 15:57
I found another hint in another answer here on StackOverflow: basically, just sign the user out. –  Marnix Klooster Feb 10 '11 at 20:24

This article describes a "step-up" procedure that might help you in this scenario. I haven't used it though, so I can't comment in detail. It looks very close to what you are trying to do.

share|improve this answer

Your Answer


