SAML 2.0 tokens and WIF – bridging the divide

Background We all know the following limitations about Windows Identity Foundation (WIF) and passive (browser) federation protocols, right? WIF does not support SAML2.0 protocol (SAML2P) There is a WIF extension out there to support SAML2P but it is a technology preview WIF does support SAML2.0 (SAML2) tokens WS-Federation conveys SAML1.1 tokens Therefore, unless you use…

5

Access to an ASP.NET website via multiple authentications

Background Is it possible to secure a website using Windows Identity Foundation (WIF) without interfering with an existing authentication method? e.g. – Could a website secured using an ASP.NET membership provider, with all the code and configuration that entails, be layered with additional code and configuration to allow a precursory authentication with a trusted Identity…

2

Claims to Windows Token Service keeps entering disabled state

On a recent project I was tasked with securing an ASP.NET MVC site using ADFS. There was also a requirement to flow the end-user identity down through the various tiers, necessitating the use of Kerberos Constrained Delegation (KCD). In order to achieve KCD, the SAML assertion returned from ADFS must first be converted to a…

2

Write a custom security token and handler in Windows Identity Foundation

In this article I will demonstrate how to write a token handler for a custom token in Windows Identity Foundation (WIF). The likely circumstances for requiring a new token type are: The token type is pre-existing and needs to be federated The new token type is an extension to a token type already supported by…

2

Windows Azure toolkit for Windows Phone 7

Hi all I am having great fun playing with this toolkit to see how WP7 apps can be properly secured using the Azure Access Control Service (ACS). I hit a couple of problems while trying to create a new ‘Windows Phone Cloud Application’ project in Visual Studio though, at the following screen: 1) Make sure the ACS namespace is…


Windows Identity Foundation 101’s

Hi I am in the process of creating a series of 101’s for Windows Identity Foundation and ADFS 2. Keep an eye out for them. Here are the first two: http://blogs.msdn.com/b/mcsuksoldev/archive/2010/07/07/windows-identity-foundation-101-s-ws-federation-passive-requestor-profile-part-1-of-2.aspx http://blogs.msdn.com/b/mcsuksoldev/archive/2010/07/07/windows-identity-foundation-101-s-ws-federation-passive-requestor-profile-part-2-of-2.aspx Later. Brad