ADFS/C2WTS identity impersonation failure after an IIS reset

ADFS/C2WTS identity impersonation failure after an IIS reset by MonkeyTennis

Active

Type:	Bug
ID:	733737
Opened:	3/27/2012 3:17:24 PM
Access Restriction:	Public

Workaround(s)

view

User(s) can reproduce this bug

The problem is easily reproduced using the following steps:
•Create an empty ASP.NET website and set up federation with ADFS
◦Ensure that a UPN claim is emitted by ADFS
•Modify C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe.config to allow access to authenticated users
•Start the C2WTS service via start-run-services.msc
•Modify the ASP.NET web.config file to enable identity impersonation
•Log in via ADFS
•Perform an IIS reset
•Refresh the page

The following error will occur:

Either a required impersonation level was not provided, or the provided impersonation level is invalid. (Exception from HRESULT: 0x80070542)

This error is fairly catastrophic as the entire app pool is compromised until it is recycled. i.e. – it is not the currently logged in user that no longer has access, it is all users!

The solution is to remove the default SessionSecurityTokenHandler implementation from the microsoft.identityModel config section and add in a new one where the useWindowsTokenService flag is set to true. However, this is by no means intuitive and we should strongly consider making the useWindowstokenService flag equal true by default IF the C2WTS service is used for the initial token parsing.

Details (expand)

A user session should be able to survive an IIS reset.

Functionality

0 attachments

The solution is to remove the default SessionSecurityTokenHandler implementation from the microsoft.identityModel config section and add in a new one where the useWindowsTokenService flag is set to true. However, this is by no means intuitive and we should strongly consider making the useWindowstokenService flag equal true by default.

<microsoft.identityModel>
    <service>
     ...
     <securityTokenHandlers>
        <remove type="Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
        <add type="Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
         <sessionTokenRequirement useWindowsTokenService="true"/>
        </add>
        <add type="Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
         <samlSecurityTokenRequirement mapToWindows="true" useWindowsTokenService="true" />
        </add>
     </securityTokenHandlers>
     ...
    </service>
</microsoft.identityModel>