1. Tech Ed North America 2010
11/21/2018 1:22 AM
Required Slide
SESSION CODE: OSP306
Developing Microsoft SharePoint Server 2010 Solutions with Claims Authentication
Paul Schaeflein, MCT
Manager of Advanced Technologies
LaSalle Consulting Partners, Inc.
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Agenda Claims-Based Identity Claims-Based Authorization
Claims Provider
Anonymous Access
Trusted Identity Providers

3. Claims-Based Identity

4. Claims-Based Identity primer Introduction
What is Identity?
A set of attributes to describe a user.
What is a Claim?
Information such as name, , age, group membership, etc.

5. Claims-Based Identity primer Introduction
What is Authentication (AuthN)?
The process of verifying a user’s identity.
What is Authorization (AuthZ)?
Determines which sites, content, and other features the user can access.

6. Claims-Based Identity primer User Identity is a set of claims
Why do we say “claim” and not “attribute?”
Facebook & the Dept. of State have the age attribute
Facebook can claim 29 yrs, while State claims 46 yrs.
In order to make authorization decisions with age, your app needs to decide which “claim” you will trust.
Trust depends on scenario not on technical capability

7. Claims is more than Federation
Federation between organizations was the original driver
Over time, claims turned out to be useful for more than just Federation
Real Benefit: Cleanly factoring out the Identity Provider from the application is invaluable
SharePoint is Identity Provider neutral
Multi-auth web applications

8. Identity Normalization
Anonymous User
NT Token Windows Identity
SAML Token LiveID, ADFS, Others
ASP.Net (FBA) SAL, LDAP, Custom …
SAML Token
Claims Based Identity
SPUser

9. Multi-auth Web Applications

10. Claims-Based Identity
Claims Viewer Web Part
Multi-Auth web application
DEMO

11. Claims Viewer Web Part

12. Claims Viewer Web Part
IClaimsPrincipal claimsPrincipal = Page.User as IClaimsPrincipal;
IClaimsIdentity claimsIdentity = (IClaimsIdentity)claimsPrincipal.Identity;
GridView1.DataSource = claimsIdentity.Claims;

13. Claims-Based Authorization

14. Claims-Based Authorization
Available to securable objects thru People-Picker
Access Claims via IClaimsIdentity interface
Claims property contains all claims
Conditionally Display information
based on presence of claim
based on value of claim

15. People Picker

16. Claims-Based Authorization
Select claim in People Picker
Conditional information display
DEMO

17. Conditional Information Display

18. Conditional Information Display
IClaimsPrincipal claimsPrincipal = Page.User as IClaimsPrincipal;
IClaimsIdentity claimsIdentity = (IClaimsIdentity)claimsPrincipal.Identity;
string pmClaim = (from c in claimsIdentity.Claims
where c.ClaimType == CLAIM_TYPE
select c.Value).FirstOrDefault();
bool authorized = bool.Parse(pmClaim);

19. Custom Claims Provider

20. Custom SharePoint Claims Provider
Two roles
Claims Augmentation
Claims Picker
!! Not authentication !! (Use WIF classes for AuthN)
Usage Scenarios
List, Resolve and Search
AllUsers claim
Adding Claims to original token (claims augmentation)
Identity not from original token (map to internal identity)

21. Claims Provider Claims Augmentation
Enables an application to augment additional claims into the user’s token
Implemented as a Claims Provider class
FillClaimsForEntity called by framework
Microsoft.SharePoint.Administration.Claims.SPClaimProvider
Register in Feature Event Receiver
Microsoft.SharePoint.Administration.Claims.SPClaimProviderFeatureReceiver
MSDN Article by Steve Peschka:

22. Claims Provider Claims Picker
Provides Listing, Resolve, Search and Friendly display of claims in the People Picker
Implemented as a Claims Provider class
FillHierarchy, FillResolve, FillSearch called by framework
Microsoft.SharePoint.Administration.Claims.SPClaimProvider
Register in Feature Event Receiver
Microsoft.SharePoint.Administration.Claims.SPClaimProviderFeatureReceiver
Claim Type and Values must match!

23. Custom Claims Provider
Augment claims based on database values
Resolve Claims in People Picker
DEMO

24. FillClaimForEntity() method
Parameters
Context (URI)
Current user (userid claim)
Empty list to contain new claims
Called once per session
Token is passed as cookie once issued

25. CreateClaim() Parameters
claimType Type: String The type of claim. Examples of claim types include first name, role and address. The claim type provides context for the claim value, and it is usually expressed as a Uniform Resource Identifier (URI). For example, the address claim type is represented as
value Type: String The value of the claim. For example, if the claim type is role, a value might be contributor, and if the claim type is first name, a value might be Matt. 
valueType Type: String The type of value in the claim. These are all URIs that refer to a string.

26. ClaimValueTypes (selected)
Base64Binary
Boolean
Date
Datetime
DaytimeDuration
String

27. Anonymous Access

28. Claims in Anonymous scenario
No Claims!

29. Establishing Anonymous Access
Web Application
Manage web application
Authentication Providers
Edit Zone
Allow Anonymous
$wa = get-spwebapplication
$zone = [Microsoft.SharePoint.Administration.SPUrlZone]::Custom
$i = $wa.IisSettings[$zone]
$i.AllowAnonymous = $true
$wa.Update()
$wa.ProvisionGlobally()

30. Establishing Anonymous Access
Site (SPWeb)
Site Actions -> Site Permission
Anonymous Access
Nothing [AnonymousState.Disabled]
Entire site [AnonymousState.On]
Lists and Libraries [AnonymousState.Enabled]
$w = Get-SPWeb
$w.AnonymousState = [Microsoft.SharePoint.SPWeb+AnonymousState]::On
$w.Update()

31. Establishing Anonymous Access
List
List Settings
Anonymous Access
$w = get-spweb
$l = $w.Lists["Comments"]
$l.AnonymousPermMask64 = {BasePermissions as appropriate}

32. Trusted Identity Providers

33. Trusted Identity Providers
Active Directory Federation Services (ADFS)
Previously known as “Geneva server”
Windows Live ID
Open ID

34. ADFS 2.0 Separate Download Identity across organizational boundaries
Identity across organizational boundaries
Attribute stores
Active Directory
Others

35. Windows Live ID Extract X509 Cert from metadata
Set Return URL to _trust/default.aspx
Watch TechNet for further information

36. Open ID Must be “Translated” into SAML Claims Many OpenID Providers
WIF code
Pioneering work
Matias Woloski
Travis Nielsen
Many OpenID Providers

37. Trusted Identity Providers
Demo

38. Track Resources For More Information – http://sharepoint.microsoft.com
Required Slide
Track PMs will supply the content for this slide, which will be inserted during the final scrub.
Tech Ed North America 2010
11/21/2018 1:22 AM
Track Resources
For More Information –
SharePoint Developer Center –
SharePoint Tech Center –
Official SharePoint Team Blog –
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

39. Required Slide
Speakers, please list the Breakout Sessions, Interactive Sessions, Labs and Demo Stations that are related to your session.
Tech Ed North America 2010
11/21/2018 1:22 AM
Related Content
Breakout Sessions – See Conference Guide for full list of OSP Track Sessions
Interactive Sessions – OSP Track has 10 Interactive Sessions – OSP01-INT – OSP10-INT
Hands-on Labs – OSP01-HOL – OSP20-HOL
Product Demo Stations – Yellow Section, OSP
Office 2010, SharePoint 2010, Project Server 2010, Visio have kiosks and demos
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

40. Resources Learning Required Slide www.microsoft.com/teched
Tech Ed North America 2010
11/21/2018 1:22 AM
Required Slide
Resources
Learning
Sessions On-Demand & Community
Microsoft Certification & Training Resources
Resources for IT Professionals
Resources for Developers
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

41. Complete an evaluation on CommNet and enter to win!
Tech Ed North America 2010
11/21/2018 1:22 AM
Required Slide
Complete an evaluation on CommNet and enter to win!
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

42. Sign up for Tech·Ed 2011 and save $500 starting June 8 – June 31st
You can also register at the North America 2011 kiosk located at registration Join us in Atlanta next year

43. Play the Microsoft Office & SharePoint Track Tag Contest
Tech·Ed  North America 2009
11/21/2018 1:22 AM
Play the Microsoft Office & SharePoint Track Tag Contest
Download the Microsoft Tag Reader
Open the internet browser on your mobile phone
and visit
Grand Prize (1)
Xbox 360 Prize Package
and Microsoft® Office 2010
Daily Prizes
40 copies of
Microsoft® Office 2010
Come to the Expo Hall – Yellow Section OSP Info Desk
for Official Rules & Collect Additional Tags from all OSP Track Sessions, Speakers and Expo Hall!
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

44. Tech Ed North America 2010 11/21/2018 1:22 AM
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

45. Required Slide Tech Ed North America 2010 11/21/2018 1:22 AM
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.