title: SSO/SAML with .NET application
body: <p><em>Background</em></p>
  
  <p>I have a .NET (not MVC or ASP.NET) application (which is an Excel plugin), which performs 1 REST call for data (REST call is a protected resources - requires authenticated user).
  Currently this Excel plugin authenticates with the REST backend using basic authentication (with username/password input fields).
  Users are authenticated on a Windows domain.</p>
  
  <p><em>Problem</em></p>
  
  <p>I want to get rid of the username/password inputs and start using SAML2 to achieve true single signon for these users.from within this .NET application.</p>
  
  <p><strong><em>Question 1: Is it possible to perform client-side SAML2 authentication for my app?</em></strong></p>
  
  <p><em>Which framework/library to use?</em></p>
  
  <p>If it is possible (I hope so...), I found this info:</p>
  
  <p>"No is official C# client-side protocol stack", but there are various 3rd party libraries which implement SAML2", but these seem all focused on ASP.NET.</p>
  
  <ul>
  <li>Sustainsys.Saml2</li>
  <li>OneLogin</li>
  <li>AspNetSaml</li>
  <li>ITfoxtec</li>
  </ul>
  
  <p>I've tried several libraries but they all seem to want to redirect the user (in browser - which I don't use in the app) to a specific endpoint.</p>
  
  <p>I am no .NET guru, so if it is possible, any library with a clear example/tutorial would be really appreciated.</p>
  
  <p><strong>Followup 2018-12-13</strong></p>
  
  <p><em>So, real SAML authentication is only possible when including a WebBrowserControl in a custom pane in this Excel Add-In application.
  This WebBrowserControl will handle the SAML negotiation (including following all redirects etc).
  However, I just noticed when I access the URL which triggers the SAML authentication in Firefox (which has empty NTLM trusted URIs) that I get an authentication popup. When I enter my credentials I am authenticated.</em></p>
  
  <p><strong>Question 2</strong></p>
  
  <p>Can I still perform the SAML negotiation in the .NET backend without the WebBrowserControl, but by supplying the username + password which I currently still have in my GUI?
  Can I set the correct headers at some point in the process?
  If so, how?</p>