Skip to content

Docs feedback - feature proposal: ADFS oAuth2 Authentication

Problem to solve

issue identified with method followed by adfssrv oAuth2 authentication

Intended users

all corporate user who want to use inhouse identity for authentication by default

Further details

Below are the logs for the test case using adfssrv oAuth2 authentication, where we were unable to retrieve user profile details under user info page from adfssrv

March 25, 2019 20:36: (OAuth) Error saving user (): ["Email can't be blank", "Notification email can't be blank"]

Proposal

Ad per Microsoft KB for ADFS, resource URL must be included in every request Sent to ADFS Server : Link 1 for custom-id-tokens-in-ad-fs

custom-id-tokens-in-ad-fs

Link 2 for ad-fs-scenarios-for-developers ad-fs-scenarios-for-developers

  • Authorization request:

  • GET https://fs.contoso.com/adfs/oauth2/authorize?

  • Parameter | Value

  • response_type |"code"

  • resource | RP ID (Identifier) of Web API in application group

  • client_id | Client Id of the native application in the application group

  • redirect_uri | Redirect URI of web app (server application) in application group

  • Token request:

  • POST https://fs.contoso.com/adfs/oauth2/token

  • Parameter | Value

  • grant_type | "authorization_code"

  • code | authorization code from 2 above

  • resource | RP ID (Identifier) of Web API in application group

  • client_id | Client Id of the web app (server application) in the application group

  • redirect_uri | Redirect URI of web app (server application) in application group

  • client_secret | Secret of the web app (server application) in the application group.

  • Note: The client's credential does not need to be a client_secret. AD FS supports the ability to use certificates or Windows Integrated Authentication as well.

Similarly While initiating flow to request user info from ADFS, Gitlab must include Resource in URL.

Permissions and Security

Ad per Microsoft KB for ADFS, resource URL must be included in every request Sent to ADFS Server, While retrieving token from ADFS, ADFS will return additional claims as defined in ADFS Settings. on getting user profile info using same token along with resource URL, it will return all user profile properties as per custom claim configuration. these are the property like, first name, last name, email address, group membership, etc.

Documentation

See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements

What does success look like, and how can we measure that?

tested Partial Functionality with minor change in Token request URL by adding resource=(Gitlab Callback URL again) below are the logs collected from adfssrv Server

Below are the 2 events generated post requesting token without specifying resource in URL:

You may take a note of RelyingParty under event id 1202 and 1200 respectively.

https://adfssrv.domain.com/adfs/oauth2/authorize/?client_id=df885c03-b3f0-4b08-be4d-43b29db60ae0&redirect_uri=http%3A%2F%2F10.1xx.2x.1x%2Fusers%2Fauth%2Foauth2_generic%2Fcallback&response_type=code&scope=openid+email+group&state=e8e2cff88df4ccdc94d519cc32950b63525c18f0e4986ddf&client-request-id=9a2c1654-43f8-4d0d-d305-0080000000bd&pullStatus=0

Log Name:      Security
Source:        AD FS Auditing
Date:          3/25/2019 9:54:52 PM
Event ID:      1202
Task Category: (3)
Level:         Information
Keywords:      Classic,Audit Success
User:          domain\adfssrvgmsa$
Computer:      domaincontroller.domain.COM
Description:
The Federation Service validated a new credential. See XML for details. 

Activity ID: 53c2335b-a1c8-4608-e507-0080020000cd 

Additional Data 
XML: <?xml version="1.0" encoding="utf-16"?>
<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="FreshCredentialAudit">
  <AuditType>FreshCredentials</AuditType>
  <AuditResult>Success</AuditResult>
  <FailureType>None</FailureType>
  <ErrorCode>N/A</ErrorCode>
  <ContextComponents>
    <Component xsi:type="ResourceAuditComponent">
      <RelyingParty>**http://adfssrv.domain.com/adfssrv/services/trust**</RelyingParty>
      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>
      <UserId>domain\testuser</UserId>
    </Component>
    <Component xsi:type="AuthNAuditComponent">
      <PrimaryAuth>N/A</PrimaryAuth>
      <DeviceAuth>false</DeviceAuth>
      <DeviceId>N/A</DeviceId>
      <MfaPerformed>false</MfaPerformed>
      <MfaMethod>N/A</MfaMethod>
      <TokenBindingProvidedId>false</TokenBindingProvidedId>
      <TokenBindingReferredId>false</TokenBindingReferredId>
      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>
    </Component>
    <Component xsi:type="ProtocolAuditComponent">
      <OAuthClientId>N/A</OAuthClientId>
      <OAuthGrant>N/A</OAuthGrant>
    </Component>
    <Component xsi:type="RequestAuditComponent">
      <Server>**http://adfssrv.domain.com/adfssrv/services/trust**</Server>
      <AuthProtocol>OAuth</AuthProtocol>
      <NetworkLocation>Intranet</NetworkLocation>
      <IpAddress>10.1xx.1xx.1xx</IpAddress>
      <ForwardedIpAddress />
      <ProxyIpAddress>N/A</ProxyIpAddress>
      <NetworkIpAddress>N/A</NetworkIpAddress>
      <ProxyServer>N/A</ProxyServer>
      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; WOW64; rv:65.0) Gecko/20100101 Firefox/65.0</UserAgentString>
      <Endpoint>**/adfssrv/oauth2/authorize/**</Endpoint>
    </Component>
  </ContextComponents>
</AuditBase>
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="AD FS Auditing" />
    <EventID Qualifiers="0">1202</EventID>
    <Level>0</Level>
    <Task>3</Task>
    <Keywords>0x80a0000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-25T16:24:52.039036300Z" />
    <EventRecordID>803174</EventRecordID>
    <Channel>Security</Channel>
    <Computer>domaincontroller.domain.COM</Computer>
    <Security UserID="S-1-5-21-3634922323-348003478-4011813920-1112" />
  </System>
  <EventData>
    <Data>53c2335b-a1c8-4608-e507-0080020000cd</Data>
    <Data>&lt;?xml version="1.0" encoding="utf-16"?&gt;


============================================================

Log Name:      Security
Source:        AD FS Auditing
Date:          3/25/2019 9:54:52 PM
Event ID:      1200
Task Category: (3)
Level:         Information
Keywords:      Classic,Audit Success
User:          domain\adfssrvgmsa$
Computer:      domaincontroller.domain.COM
Description:
The Federation Service issued a valid token. See XML for details. 

Activity ID: 53c2335b-a1c8-4608-e507-0080020000cd 

Additional Data 
XML: <?xml version="1.0" encoding="utf-16"?>
<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AppTokenAudit">
  <AuditType>AppToken</AuditType>
  <AuditResult>Success</AuditResult>
  <FailureType>None</FailureType>
  <ErrorCode>N/A</ErrorCode>
  <ContextComponents>
    <Component xsi:type="ResourceAuditComponent">
      <RelyingParty>**urn:microsoft:userinfo**</RelyingParty>
      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>
      <UserId>domain\testuser</UserId>
    </Component>
    <Component xsi:type="AuthNAuditComponent">
      <PrimaryAuth>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</PrimaryAuth>
      <DeviceAuth>false</DeviceAuth>
      <DeviceId>N/A</DeviceId>
      <MfaPerformed>false</MfaPerformed>
      <MfaMethod>N/A</MfaMethod>
      <TokenBindingProvidedId>false</TokenBindingProvidedId>
      <TokenBindingReferredId>false</TokenBindingReferredId>
      <SsoBindingValidationLevel>TokenUnbound</SsoBindingValidationLevel>
    </Component>
    <Component xsi:type="ProtocolAuditComponent">
      <OAuthClientId>**df885c03-b3f0-4b08-be4d-43b29db60ae0**</OAuthClientId>
      <OAuthGrant>code</OAuthGrant>
    </Component>
    <Component xsi:type="RequestAuditComponent">
      <Server>**http://adfssrv.domain.com/adfssrv/services/trust**</Server>
      <AuthProtocol>OAuth</AuthProtocol>
      <NetworkLocation>Intranet</NetworkLocation>
      <IpAddress>10.1xx.1xx.1xx</IpAddress>
      <ForwardedIpAddress />
      <ProxyIpAddress>N/A</ProxyIpAddress>
      <NetworkIpAddress>N/A</NetworkIpAddress>
      <ProxyServer>N/A</ProxyServer>
      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; WOW64; rv:65.0) Gecko/20100101 Firefox/65.0</UserAgentString>
      <Endpoint>/adfssrv/oauth2/authorize/</Endpoint>
    </Component>
  </ContextComponents>
</AuditBase>
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="AD FS Auditing" />
    <EventID Qualifiers="0">1200</EventID>
    <Level>0</Level>
    <Task>3</Task>
    <Keywords>0x80a0000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-25T16:24:52.117151500Z" />
    <EventRecordID>803179</EventRecordID>
    <Channel>Security</Channel>
    <Computer>domaincontroller.domain.COM</Computer>
    <Security UserID="S-1-5-21-3634922323-348003478-4011813920-1112" />
  </System>
  <EventData>
    <Data>53c2335b-a1c8-4608-e507-0080020000cd</Data>
    <Data>&lt;?xml version="1.0" encoding="utf-16"?&gt;

==================================================================

While simile testing performed by adding resource in request URL. and RelyingParty has actual resource entry.

https://adfssrv.domain.com/adfs/oauth2/authorize/?client_id=df885c03-b3f0-4b08-be4d-43b29db60ae0&resource=http%3A%2F%2F10.1xx.2x.1x%2Fusers%2Fauth%2Foauth2_generic%2Fcallback&redirect_uri=http%3A%2F%2F10.1xx.2x.1x%2Fusers%2Fauth%2Foauth2_generic%2Fcallback&response_type=code&scope=openid+email+group&state=e8e2cff88df4ccdc94d519cc32950b63525c18f0e4986ddf&client-request-id=9a2c1654-43f8-4d0d-d305-0080000000bd&pullStatus=0

Log Name:      Security
Source:        AD FS Auditing
Date:          3/25/2019 9:57:32 PM
Event ID:      1202
Task Category: (3)
Level:         Information
Keywords:      Classic,Audit Success
User:          domain\adfssrvgmsa$
Computer:      domaincontroller.domain.COM
Description:
The Federation Service validated a new credential. See XML for details. 

Activity ID: c8eed3a4-8974-4495-ef07-0080020000cd 

Additional Data 
XML: <?xml version="1.0" encoding="utf-16"?>
<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="FreshCredentialAudit">
  <AuditType>FreshCredentials</AuditType>
  <AuditResult>Success</AuditResult>
  <FailureType>None</FailureType>
  <ErrorCode>N/A</ErrorCode>
  <ContextComponents>
    <Component xsi:type="ResourceAuditComponent">
      <RelyingParty>**http://10.1xx.2x.1x/users/auth/oauth2_generic/callback**</RelyingParty>
      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>
      <UserId>domain\testuser</UserId>
    </Component>
    <Component xsi:type="AuthNAuditComponent">
      <PrimaryAuth>N/A</PrimaryAuth>
      <DeviceAuth>false</DeviceAuth>
      <DeviceId>N/A</DeviceId>
      <MfaPerformed>false</MfaPerformed>
      <MfaMethod>N/A</MfaMethod>
      <TokenBindingProvidedId>false</TokenBindingProvidedId>
      <TokenBindingReferredId>false</TokenBindingReferredId>
      <SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>
    </Component>
    <Component xsi:type="ProtocolAuditComponent">
      <OAuthClientId>N/A</OAuthClientId>
      <OAuthGrant>N/A</OAuthGrant>
    </Component>
    <Component xsi:type="RequestAuditComponent">
      <Server>http://adfssrv.domain.com/adfssrv/services/trust</Server>
      <AuthProtocol>OAuth</AuthProtocol>
      <NetworkLocation>Intranet</NetworkLocation>
      <IpAddress>10.1xx.1xx.1xx</IpAddress>
      <ForwardedIpAddress />
      <ProxyIpAddress>N/A</ProxyIpAddress>
      <NetworkIpAddress>N/A</NetworkIpAddress>
      <ProxyServer>N/A</ProxyServer>
      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; WOW64; rv:65.0) Gecko/20100101 Firefox/65.0</UserAgentString>
      <Endpoint>**/adfssrv/oauth2/authorize/**</Endpoint>
    </Component>
  </ContextComponents>
</AuditBase>
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="AD FS Auditing" />
    <EventID Qualifiers="0">1202</EventID>
    <Level>0</Level>
    <Task>3</Task>
    <Keywords>0x80a0000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-25T16:27:32.935833200Z" />
    <EventRecordID>803188</EventRecordID>
    <Channel>Security</Channel>
    <Computer>domaincontroller.domain.COM</Computer>
    <Security UserID="S-1-5-21-3634922323-348003478-4011813920-1112" />
  </System>
  <EventData>
    <Data>c8eed3a4-8974-4495-ef07-0080020000cd</Data>
    <Data>&lt;?xml version="1.0" encoding="utf-16"?&gt;

====================================================

Log Name:      Security
Source:        AD FS Auditing
Date:          3/25/2019 9:57:33 PM
Event ID:      1200
Task Category: (3)
Level:         Information
Keywords:      Classic,Audit Success
User:          domain\adfssrvgmsa$
Computer:      domaincontroller.domain.COM
Description:
The Federation Service issued a valid token. See XML for details. 

Activity ID: c8eed3a4-8974-4495-ef07-0080020000cd 

Additional Data 
XML: <?xml version="1.0" encoding="utf-16"?>
<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AppTokenAudit">
  <AuditType>AppToken</AuditType>
  <AuditResult>Success</AuditResult>
  <FailureType>None</FailureType>
  <ErrorCode>N/A</ErrorCode>
  <ContextComponents>
    <Component xsi:type="ResourceAuditComponent">
      <RelyingParty>**http://10.1xx.2x.1x/users/auth/oauth2_generic/callback**</RelyingParty>
      <ClaimsProvider>AD AUTHORITY</ClaimsProvider>
      <UserId>domain\testuser</UserId>
    </Component>
    <Component xsi:type="AuthNAuditComponent">
      <PrimaryAuth>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</PrimaryAuth>
      <DeviceAuth>false</DeviceAuth>
      <DeviceId>N/A</DeviceId>
      <MfaPerformed>false</MfaPerformed>
      <MfaMethod>N/A</MfaMethod>
      <TokenBindingProvidedId>false</TokenBindingProvidedId>
      <TokenBindingReferredId>false</TokenBindingReferredId>
      <SsoBindingValidationLevel>TokenUnbound</SsoBindingValidationLevel>
    </Component>
    <Component xsi:type="ProtocolAuditComponent">
      <OAuthClientId>**df885c03-b3f0-4b08-be4d-43b29db60ae0**</OAuthClientId>
      <OAuthGrant>code</OAuthGrant>
    </Component>
    <Component xsi:type="RequestAuditComponent">
      <Server>**http://adfssrv.domain.com/adfssrv/services/trust**</Server>
      <AuthProtocol>OAuth</AuthProtocol>
      <NetworkLocation>Intranet</NetworkLocation>
      <IpAddress>10.1xx.1xx.1xx</IpAddress>
      <ForwardedIpAddress />
      <ProxyIpAddress>N/A</ProxyIpAddress>
      <NetworkIpAddress>N/A</NetworkIpAddress>
      <ProxyServer>N/A</ProxyServer>
      <UserAgentString>Mozilla/5.0 (Windows NT 10.0; WOW64; rv:65.0) Gecko/20100101 Firefox/65.0</UserAgentString>
      <Endpoint>**/adfssrv/oauth2/authorize/**</Endpoint>
    </Component>
  </ContextComponents>
</AuditBase>
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="AD FS Auditing" />
    <EventID Qualifiers="0">1200</EventID>
    <Level>0</Level>
    <Task>3</Task>
    <Keywords>0x80a0000000000000</Keywords>
    <TimeCreated SystemTime="2019-03-25T16:27:33.013934500Z" />
    <EventRecordID>803193</EventRecordID>
    <Channel>Security</Channel>
    <Computer>domaincontroller.domain.COM</Computer>
    <Security UserID="S-1-5-21-3634922323-348003478-4011813920-1112" />
  </System>
  <EventData>
    <Data>c8eed3a4-8974-4495-ef07-0080020000cd</Data>
    <Data>&lt;?xml version="1.0" encoding="utf-16"?&gt;

Links / references

custom-id-tokens-in-ad-fs

ad-fs-scenarios-for-developers