Programming Windows Identity Foundation Book

Foreword

Acknowledgments

Introduction

Part I Windows Identity Foundation for Everybody

1 Claims-Based Identity? 3

What Is Claims-Based Identity? 3

Traditional Approaches to Authentication 4

Decoupling Applications from the Mechanics of Identity and Access 8

WIF Programming Model 15

An API for Claims-Based Identity 16

WIF's Essential Behavior 16

IClaimsidentity and IClaims Principal 18

Summary 21

2 Core ASP.Net Programming 23

Externalizing Authentication 24

WIF Basic Anatomy: What You Get Out of the Box 24

Our First Example: Outsourcing Web Site Authentication to an STS 25

Authorization and Customization 33

ASP.NET Roles and Authorization Compatibility 36

Claims and Customization 37

A First Look at <microsoft.identityModel> 39

Basic Claims-Based Authorization 41

Summary 46

Part II Windows Identity Foundation for Identity Developers

3 WIF Processing Pipeline in ASP.NET 51

Using Windows Identity Foundation 52

WS-Federation: Protocol, Tokens, Metadata 54

WS-Federation 55

The Web Browser Sign-in Flow 57

A Closer Look to Security Tokens 62

Metadata Documents 69

How WIF Implements WS-Federation 72

The WIF Sign-in Flow 74

WIF Configuration and Main Classes 82

A Second Look at <microsoft.identityModel> 82

Notable Classes 90

Summary 94

4 Advanced ASP.NET Programming 95

More About Externalizing Authentication 96

Identity Providers 97

Federation Providers 99

The WIF STS Template 102

Single Sign-on, Single Sign-out, and Sessions 112

Single Sign-on 113

Single Sign-out 115

More About Sessions 122

Federation 126

Transforming Claims 129

Pass-Through Claims 134

Modifying Claims and Injecting New Claims 135

Home Realm Discovery 135

Step-up Authentication, Multiple Credential Types, and Similar Scenarios 140

Claims Processing at the RP 141

Authorization 142

Authentication and Claims Processing 142

Summary 143

5 WIF and WCF 145

The Basics 146

Passive vs. Active 146

Canonical Scenario 154

Custom TokenHandlers 163

Object Model and Activation 167

Client-Side Features 170

Delegation and Trusted Subsystems 170

Taking Control of Token Requests 179

Summary 184

6 WIF and Windows Azure 185

The Basics 186

Packages and Config Files 187

The WIF Runtime Assembly and Windows Azure 188

Windows Azure and X.509 Certificates 188

Web Roles 190

Sessions 191

Endpoint Identity and Trust Management 192

WCF Roles 195

Service Metadata 195

Sessions 196

Tracing and Diagnostics 201

WIF and ACS 204

Custom STS in the Cloud 205

Dynamic Metadata Generation 205

RP Management 213

Summary 213

7 The Road Ahead 215

New Scenarios and Technologies 215

ASP.NET MVC 216

Silverlight 223

SAML Protocol 229

Web Identities and REST 230

Conclusion 239

Index 241