Troubleshooting WIF ID3206 Error
Problem Statement
While trying to browse to a WIF enabled application - https://myApplication/WebAppHome, we get the following error –
ID3206: A SignInResponse message may only redirect within the current web application: '/DPWebApps' is not allowed.
However, the same application works when we are browsing with a trailing slash – “/”, i.e. https://myApplication/WebAppHome/
The goal is to troubleshoot the ID3206 exception.
Research
This issue occurs when the URL of the relying party lacks forward slash at the end.
Doing some fair amount of research, we are able find out that this is a known issue. The following links talk more about this –
Workarounds
There are quite a number of workarounds available to get around the issue. They are listed as below:
- Use WSFederationAuthenticationModule and override RedirectToIdentityProvider
public class FixedWSFederationAuthenticationModule : WSFederationAuthenticationModule
{
public override void RedirectToIdentityProvider(string uniqueId, string returnUrl, bool persist)
{
//First Check if the request url doesn't end with a "/"
if (!returnUrl.EndsWith("/"))
{
//Compare if Request Url +"/" is equal to the Realm, so only root access is corrected
//https://localhost/AppName plus "/" is equal to https://localhost/AppName/
//This is to avoid MVC urls
if (String.Compare(System.Web.HttpContext.Current.Request.Url.AbsoluteUri + "/", base.Realm, StringComparison.InvariantCultureIgnoreCase) == 0)
{
//Add the trailing slash
returnUrl += "/";
}
}
base.RedirectToIdentityProvider(uniqueId, returnUrl, persist);
}
}
2. Or, you can add a handler in global.asax like the one below which detects the "no-trailing-slash" situation and redirects to the same path with the slash appended.
private void Application_BeginRequest(object sender, EventArgs e)
{
if ( String.Compare( Request.Path, Request.ApplicationPath, StringComparison.InvariantCultureIgnoreCase) == 0 !( Request.Path.EndsWith("/") ) )
Response.Redirect(Request.Path + "/");
}
3. Or, this can also be handled in the Application_Error method of Global_asax file.
if(ex.Message.StartsWith("ID3206:"))
{
if (String.Compare(Request.Path, Request.ApplicationPath, StringComparison.InvariantCultureIgnoreCase) == 0 && !(Request.Path.EndsWith("/")))
Response.Redirect(Request.Path + "/");
}
Here ex is the ExceptionContext object.
4. Other workarounds may involve adding a URL rewrite rule in IIS that adds a trailing slash.