System.Windows.Forms.WebBrowser sometimes does NTLM auth - why? - c#

I have a Windows Forms app targeting .NET 2.0. I'm attempting to add a single sign-on feature via the SAML 2.0 protocol, for which the most efficient apparent solution was an embedded web browser.
I've verified using a dummy app containing only a WebBrowser control that the NTLM exchange does take place. However, when I embed apparently the same control into the larger application, the browser doesn't respond to the initial HTTP 401 challenge and instead redirects to IE's "Navigation Canceled" page.
The Googles have not been forthcoming, and I'm puzzled at this behavior. Can anyone shed some light on what might be inhibiting the WebBrowser's credential negotiation?

I discovered the answer during a line-by-line comparison between the (working) test app and the (not working) full app.
The key to enabling NTLM negotiation for me was to set ScriptErrorsSuppressed to false. I had intended to hide Javascript error popups from our users, but suppressing those also suppresses credential negotiation. Go figure.

Related

I Want to open a browser within an UWP app (for oAuth2 grant)

I'm developing an app which requires oAuth2.0 code authorization. So, I want to open a browser and get the Access Token by logging into their website. But I want to do that within my app, without opening any external browser. Can Anyone Help me ??
The Documentation for the oAuth is Found Here.
I Want to open a browser within an UWP app (for oAuth2 grant)
UWP platform provide WebAuthenticationBroker class to get the Access Token by logging into their website within internal webview. And here is the detail steps how to use WebAuthenticationBroker. For more info please refer to official WebAuthenticationBroker code sample.
I understand what it is that you want to do. However what you are requesting would be a security risk for the user.
There is a reason why you cant / shouldnt do this.
By using the default web browser on the users machine. The user can be sure that this was their browser of choice and not an internal browser in your system which they have no control over.
second by opening it in a browser window the user can see the URL bar and verify that the authorization server is what they expect it to be
Oauth window opening for Google oauth you can see that the server it is going to is in fact googles authorization server.
What if this was possible.
If it was possible to request authorization from with in your app and you It would be very easy for you to set up a login screen to look exactly like the login for this authorization server. The user would then have no way of knowing that this was a fake login screen they were typing their credentials into.
All that being said I am not familiar with AniList API but I would hope that they do not allow you to do this. Open consent screen in the users browser and let them know that you are concerned with their security.

OAuth2: Authorization Code Grant Flow with C#

I have an API that I want to consume with C# that uses OAuth2 with Authorization Code Grant Flow.
Does someone know an example or something on how to do it?
I want to know how I can return the Authorization code to my C# project after the user has logged in and given consent?
If you don't understand my question, I want to know how to go from step 1 to step 2 in this tutorial: https://auth0.com/docs/api-auth/tutorials/authorization-code-grant
It doesn't say how to "fetch" the "code" from the URL to my C# project.
A little bit late, but I had the same problem.
There are two solutions for getting back the code from authorization server in desktop apps.
Inner browser. If You want to use inner browser, like embeded CEFSharp, then You just want to listen to navigation event on the webbrowser control. When You authorize Your account then the server makes redirection to the specific URL that You provide. So You just catch that redirection, read the code from URL and cancel the redirection, hide the windows and so on.
Outer browser. In this case You just follow the previous steps, but insted running authorization in embeded window, You call the system browser and, what's important You set the redirect_uri to localhost/whatever:{port}. You have also run the local http server on that port (see ephemeral port), for example HttpListener Class and when the authorization process completes, server will redirect the external browser to the localhost adress You provide. The You just catch that request on Your HttpListener and You've got the code.

ASP.NET MVC 3 - Redirect Loop Only on Certain Browsers

All,
I am seeing a redirect loop occur when someone tries authenticating on IE 11 and Chrome for iPad. Very strange that a redirect loop is browser-specific but that appears to be the case.
We authenticate users with the .NET forms authentication which employs cookies. This site is running on .NET Framework 4.0
Basically our authentication process involves 3 calls to:
Redirect(url)
and has been working for the most part for quite a while.
Can this be an issue with the browser definition file not having IE 11 and some of these other tablet browsers?
I really have no idea what would cause a redirect loop in certain browsers.
Any thoughts and/or suggestions are enthusiastically welcomed!
Thanks
Have you setup forms in web.config to enforce the use of cookies? (cookieless="UseCookies")
I have seen cases where outdated browser definitions caused ASP.NET to believe that cookies cannot be used. You can easily test for that in a simple application. One time even IE10 wasn't supported (because ASP.NET only tested for IE1..IE9), but there was a Windows Update for that.
Cookies may also be rejected for several browser policies, for example by invalid hostnames, for example if it contains an underscore.

Single Sign-On on Winforms Web Browser control

I have a Winforms app which hosts a web browser control. Within this control you can also navigate to pre-determined external websites.
I need to implement Single Sign-On so that the user doesn't need to authenticate in each of the known external websites. I have already some ideas but it would be nice to hear all your opinions.
What would be the best way to do this?
In fact, is there something already for this? (edit: how do browsers remember logins/passwords)?
Cheers
Generally it is the responsibility of the site to implement SSO, and the client will then automatically respond to the site. Since the web browser control is using IE it inherits the same capabilities as the web browser. For example if the site uses Windows Authentication then the control will authenticate following a challenge from the site without user intervention. Similarly the control will perform the necessary redirects if the site is using SAML 2.0.
Since these are external websites I have to assume that Windows Authentication is not going to work well because the server and the client are on different domains. Therefore something along the lines of SAML sounds like the most secure option.
It seems like implementing SAML is going to be a problem for you and you need to manually complete and submit web forms which load inside the control. This is possible by accessing the DOM but it quickly becomes a difficult to maintain solution.
The web browser control offers up a document property that gives you an HtmlDocument object which allows you to find elements and execute JavaScript in pages. You need to use these mechanisms to automatically perform the authentication. The steps might look like this:
Capture URL, or some cookie that will let you know if authentication is required by inspecting the web browser control properties. You might want to look into OnNavigate().
Access the document and complete the form values.
Call a JavaScript submit function to submit the form, or inject some JavaScript to do this. I find it easier to insert JavaScript into pages than to write more complicated C# code in a lot of cases. It is easier to prototype in a regular browser.
Unless the websites all share a common trusted authentication mechanism (like OpenID) you're stuck doing custom coding for each site.
Browsers remember passwords for single sites. I wouldn't call that "single sign-on", which is a method of using a trusted authority to authenticate across multiple disparate web sites which all rely on that authority to verify a user's identity.
As you asked for SSO packages that already do this, some examples are:
RSA ClearTrust
CA SiteMinder

WPF Launch Browser with Credentials

I'm using WPF and C#.
I want to be able to launch a browser window, most likely IE, and provide known credentials so that the Windows-based application can handle the transition from itself to an outside browser without having the user enter his/her credentials again.
I do know how to launch the browser:
System.Diagnostics.Process.Start(url);
My main question is, how can I attach authentication to that? Perhaps by adding headers to it somehow?
Lastly, I don't really want to use the new WebBrowser control inside of WPF due to it's current problems with displaying with a transparent window.
1) You have to know how to "log in".
To do this login manually in the web application and trace the http traffic with http debugger like Fiddler. Pay attention what kind of http requests are sent, what names have the parameters, etc.
Once you know what sequence of http requests has to be send to log in you has to do this with the browser.
2) Implement log in automatically
2.1) If by any chance log in happens via http GET - just append the right query string to the url and start the browser. This could happen only if you control the web application and build in this mechanism, other wise log in is almost always implemented as POST with https.
2.2) If you have to do POST request you have several options:
2.2.1) You could provide local html document, that contains javascript and make ajax call to the login form from the javascript. To pass the parameters you could use get parameters.
2.2.2) If nothing else works you will have to use the browser via COM (WebBrowser control)
It's going to depend on how the web site handles user authentication. If you own the website, you can create a url that will log the user in with the information you provide.
Nick,
The authentication will be handled in different ways: -
Proxy Authentication is handled by Windows manually.
Forms Based authentication is handled by cookies, so the user needs to have the cookies present.
Windows NTML might be in the 'keychain' on the Operating system (Remember this password).
Cheers,
Phil.

Categories