1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

module Saml =

    let CreateSPOptions() : SPOptions =
        let spOptions = new SPOptions()
        spOptions.EntityId <- new EntityId(Settings.SamlServiceId)
        spOptions.MinIncomingSigningAlgorithm <- "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
        let certificate = new ServiceCertificate()
        certificate.Certificate <- new Security.Cryptography.X509Certificates.X509Certificate2(@"Config\Metadata\Tests.pfx")
        spOptions.ServiceCertificates.Add(certificate)
        spOptions

    let ConfigureAuthOptions() : KentorAuthServicesAuthenticationOptions =
        let spOptions = CreateSPOptions()
        let authServicesOptions = new KentorAuthServicesAuthenticationOptions(false)
        authServicesOptions.SPOptions <- spOptions
        let idp = new IdentityProvider(new EntityId(Settings.SamlIdentityProviderId), spOptions)
        idp.Binding <- Saml2BindingType.HttpRedirect
        idp.MetadataLocation <- @"Config\Metadata\idp-desc.xml"
        authServicesOptions.IdentityProviders.Add(idp);
        authServicesOptions

    let ConfigureSaml (app : IAppBuilder) =
        let cookieOptions = new CookieAuthenticationOptions()
        cookieOptions.LoginPath <- new PathString("/saml2/Login")
        cookieOptions.AuthenticationType <- "KentorAuthServices"
        cookieOptions.AuthenticationMode <- AuthenticationMode.Active
        cookieOptions.Provider <- new CookieAuthenticationProvider()

        app.UseCookieAuthentication(cookieOptions) |> ignore
        app.SetDefaultSignInAsAuthenticationType("KentorAuthServices")
        app.UseKentorAuthServicesAuthentication(ConfigureAuthOptions()) |> ignore
        app

    [<AutoOpen>]
    module AppBuilderExts =
    
        type IAppBuilder with
            member app.UseSaml() =
                ConfigureSaml(app)

1
2
3
4
5
6
7
8
9

	let options = 
		let sitelet = Site.start .......
		WebSharper.Owin.WebSharperOptions().WithSitelet(sitelet)
        
        // ...
	app
		.UseSaml()
		.UseStaticFiles(staticFileOptions)
		.UseWebSharper(options) |> ignore)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

/// NANCY code
do
    this.Get.["/login"] <-
        fun _ ->
            match this.Context.GetMSOwinUser() with
            | null ->
                let authenticationManager = this.Context.GetAuthenticationManager();
                let properties = new AuthenticationProperties()
                properties.RedirectUri <- this.Context.ToFullPath("~/saml2/login")
                authenticationManager.Challenge(properties, "KentorAuthServices")
                HttpStatusCode.Unauthorized |> box
            | user ->
                let userName = user.Identity.Name
                let ipAddress = this.Context.Request.UserHostAddress
                Log.Info "{@user} {@ipaddress} logged in" [ 
                    "user"      => userName
                    "ipaddress" => ipAddress 
                ]
                this.Context.GetRedirect("~/") |> box

1
2
3
4
5
6
7
8
9
10
11
12
13
14

/// WebSharper attempt - doesn't work
    let login =
        fun ctx -> async {
                let! user = ctx.UserSession.GetLoggedInUser()
                match user with
                | None -> 
                    let owinCtx = new OwinContext(ctx.Environment)
                    let properties = new AuthenticationProperties()
                    properties.RedirectUri <- ctx.ResolveUrl "~/login"
                    owinCtx.Authentication.Challenge(properties)
                    return! Content.Unauthorized
                | Some _ -> 
                    return! Content.RedirectPermanent ..........
            }