SAML 2.0 tokens and WIF – bridging the divide

Background We all know the following limitations about Windows Identity Foundation (WIF) and passive (browser) federation protocols, right? WIF does not support SAML2.0 protocol (SAML2P) There is a WIF extension out there to support SAML2P but it is a technology preview WIF does support SAML2.0 (SAML2) tokens WS-Federation conveys SAML1.1 tokens Therefore, unless you use…


Access to an ASP.NET website via multiple authentications

Background Is it possible to secure a website using Windows Identity Foundation (WIF) without interfering with an existing authentication method? e.g. – Could a website secured using an ASP.NET membership provider, with all the code and configuration that entails, be layered with additional code and configuration to allow a precursory authentication with a trusted Identity…


ADFS/C2WTS identity impersonation failure after an IIS reset

My team recently encountered an issue at a Relying Party website where identity impersonation in combination with ADFS authentication and the Claims to Windows Token service (C2WTS) fails after an IIS reset is performed. Reproducing the problem The problem is easily reproduced using the following steps: Create an empty ASP.NET website and set up federation…


Claims to Windows Token Service keeps entering disabled state

On a recent project I was tasked with securing an ASP.NET MVC site using ADFS. There was also a requirement to flow the end-user identity down through the various tiers, necessitating the use of Kerberos Constrained Delegation (KCD). In order to achieve KCD, the SAML assertion returned from ADFS must first be converted to a…


Write a custom security token and handler in Windows Identity Foundation

In this article I will demonstrate how to write a token handler for a custom token in Windows Identity Foundation (WIF). The likely circumstances for requiring a new token type are: The token type is pre-existing and needs to be federated The new token type is an extension to a token type already supported by…


Handling optional claims with the ADFS Claims Rule Language

It is a perfectly normal scenario for claims to be optional in a token. For example, a SAML assertion may contain the mandatory claims: and optionally the claim: The ADFS Claims Rule Language is designed to allow claims from incoming tokens to be used to query data stores for additional claims. At…


Mutual authentication with a IIS hosted WCF data service installed in a workgroup environment

This post covers the steps required to secure communication between a WCF client and a WCF data service using mutual certificate authentication. The client/service topology is depicted below: Both the client and server run on a Windows Server 2008 R2 virtual machine with Windows SDK 7.1, Visual Studio 2010, SQL Server Express 2008 R2 and…


Windows Azure toolkit for Windows Phone 7

Hi all I am having great fun playing with this toolkit to see how WP7 apps can be properly secured using the Azure Access Control Service (ACS). I hit a couple of problems while trying to create a new ‘Windows Phone Cloud Application’ project in Visual Studio though, at the following screen: 1) Make sure the ACS namespace is…

A quiz question

Using the IXmlSerializable interface, create a class that will serialize XML to be exactly the same as the following: <ns1:Root xmlns:ns1="urn:myrootnamespace"> <ns2:child xmlns:ns2="urn:mychildnamespace"> <ns2:elementInChildNS /> <ns1:elementInRootNS /> <elementInNoNS /> </ns2:child></ns1:Root> I couldn’t do it

The HTTP request is unauthorized with client authentication scheme ‘Negotiate’. The authentication header received from the server was ‘Negotiate,NTLM’

In the course of enabling WCF services using Windows authentication, you may have hit this error. A Bing search will show that there are a myriad of reasons as to why this might occur. However, before you get bogged down in the complexities of WCF bindings and IIS metadata, there ‘may’ be a simple fix….