Any news on .NET Core WS-Federation middleware?

[leastprivilege]

We have several customer who cannot upgrade to .NET core because of the lack of WS-Fed support. Any ETA?

[vibronet]

Hey there, this is still blocked on https://github.com/dotnet/corefx/issues/1132 - + @joshfree in case he has any updates

[joshfree]

/cc @danmosemsft who is driving the .NET Core 1.2 release from the corefx side now

[brentschmaltz]

@danmosemsft in addition to XmlEncrypt, we need XmlDsig.

[brentschmaltz]

@leastprivilege we will update you when we have a POR.

[vgarcia330]

I am in a holding pattern. I have a bunch of clients using WS-Federation and they are opposed to placing anything on the cloud for security authentication. I can't really move to .Net Core until this is built in to the framework.

[danmoseley]

@karelz so he sees this as it depends on https://github.com/dotnet/corefx/issues/1132

[karelz]

cc: @bartonjs @steveharter - we should reflect it in our prioritization

[bartonjs]

@brentschmaltz At this point we're only planning on bringing forward the existing SignedXml and EncryptedXml classes from NetFx (once we have time). No improved performance, no redesigned API.

So if you want to keep the performance of the SecurityModel/IdentityModel rewrite you might not be blocked on us.

[karelz]

We plan to meet (I hope next week) and discuss between .NET Core team, WIF team and ASP.NET team what is the best way forward to unblock the scenario.

[adkendall]

Also in a holding pattern here. I need to use OpenId Connect Code Flow (only possible in .dot net core if my information is correct) but also I need the ws-fed middleware, which isn't available in core. Hoping this post can help boost priority.

[huysentruitw]

Wondering if there is any update on this? We need to decide if we want to use .NET Core or not, but WS-Federation is holding us back.

@karelz how was the meeting? :)

[karelz]

Sorry for the delayed update. We met on 2016/12/14. Three teams were represented: CoreFX (myself), ASP.NET and ActiveDirectory.IdentityModel (@vibronet @brentschmaltz).

Key technical points from our discussion:

• ActiveDirectory.IdentityModel team is collecting feedback on the need for WS-Fed in .NET Core (@brentschmaltz @vibronet) - it's the driving force behind prioritization and potential funding on their side. Please keep sending the feedback, every +1 helps.
• There are 2 SignedXml versions:
  1. System.Security.Cryptography.Xml.SignedXml which is part of CoreFX (https://github.com/dotnet/corefx/issues/4278), uses XmlDocument in the API surface. This one is not used at all by WS-Fed code base. It's currently being ported to .NET Core, so it will eventually be extension of .NET Standard 2.0.
  2. System.IdentityModel.SignedXml which shipped as internal/private part of WCF/WIF in System.Identity.dll, uses XmlReader in the API surface - it is a clone of the one in CoreFX to gain better perf.
     • Currently there are no plans to open-source this version or the entire System.IdentityModel, or make it public API, or make it part of CoreFX repo. Its only purpose is to support WS-Fed.
• ASP.NET team's work seems to be small to support WS-Fed.

As a result, the key parts of supporting WS-Fed on .NET Core are:

1. Migrate WS-Fed code to .NET Core (which should be cheap-ish with .NET Core 2.0 supporting .NET Standard 2.0),
2. Decide on how SignedXml is used by WS-Fed, either
   • If System.IdentityModel.SignedXml should be ported to .NET Core and maintained as part of WS-Fed, or
   • If WS-Fed code should migrate to less-performant System.Security.Cryptography.Xml.SignedXml (which might have also impact on WS-Fed related API surface, making it not compatible with Desktop - another thing to consider), or
   • If there are other alternative solutions (e.g. build a thin wrapper of System.IdentityModel.SignedXml API surface on top of System.Security.Cryptography.Xml.SignedXml, translating XmlReader usage to XmlDocument usage), etc.
3. Migrate ASP.NET code for WS-Fed.

As you can see, the 2nd part is non-trivial and likely costly - from technical point of view it will be the biggest challenge.
Whether and how WS-Fed work will be funded will be driven by business need, which is collected by @vibronet.

Hopefully the write up helps. Sorry if it is not the news you expected - just trying to provide clarity on technical challenges here.