Suppress login redirects for API clients in WIF with Thinktecture IdentityModel

The FAM (federated authentication module) can be configured to automatically redirect http requests to the STS for authentication when a user is unauthorized. This is a common setting and is configured with the passiveRedirectEnabled attribute in web.config as such:

<system.identityModel.services>
  <federationConfiguration>
    <cookieHandler requireSsl="true" />
    <wsFederation requireHttps="true"
                  passiveRedirectEnabled="true"
                  realm="http://localhost/rp"
                  issuer="https://localhost/sts/issue/wsfed"
        />
  </federationConfiguration>
</system.identityModel.services>

The above configuration will force all unauthorized requests to be redirected, but for active API clients like Ajax and WebAPI the redirect is not useful and the unauthorized status code of 401 is preferred. The FAM supports disabling the redirect with the AuthorizationFailed event and it could be handled like this in global.asax:

void WSFederationAuthenticationModule_AuthorizationFailed(
    object sender, AuthorizationFailedEventArgs e)
{
    e.RedirectToIdentityProvider = false;
}

The hard part about implementing the above event handler is to logic to determine which requests are browser requests (and should be redirected) and which requests are API requests (and should not be redirected). APIs calls can be detected by checking for either the “X-Requested-With” http header (for Ajax requests) or if the http handler being used on the server is the HttpControllerHandler class (which is used by WebAPI).

Fortunately this logic has been implemented for you in Thinktecture IdentityModel. This feature is enabled with a SuppressLoginRedirectsForApiCalls API which should be invoked from the Init method in global.asax:

public override void Init()
{
    PassiveModuleConfiguration.SuppressLoginRedirectsForApiCalls();
}

The redirect mentioned above will also be issued for other resource requests such as CSS and JavaScript files. If it is desirable to not redirect those requests, then the FAM http module can be configured to only run for requests that execute .NET code on the server (and not for static file requests). This is done by setting the preCondition attribute to “managed” for the FAM’s http module registration in web.config:

<system.webServer>
  <modules>
    <add name="WSFederationAuthenticationModule"
         type="System.IdentityModel.Services.WSFederationAuthenticationModule,
               System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral,
               PublicKeyToken=b77a5c561934e089"
         preCondition="managed"
    />
  </modules>
</system.webServer>

HTH