1. Windows Identity Foundation Overview
11/24/2018 8:22 PM
SVC02
Windows Identity Foundation Overview
Vittorio Bertocci
Sr. Architect Evangelist
Microsoft Corporation
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Agenda Claims Based Identity Windows Identity Foundation
11/24/2018 8:22 PM
Agenda
Claims Based Identity
Windows Identity Foundation
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Your Applications Are Prisoners
11/24/2018 8:22 PM
Your Applications Are Prisoners
Login.aspx
Page1.aspx
Credential
Types / APIs
Credential
Stores
User Attributes
Stores
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Identification in Real Life Works Pretty Well …How Do We Do That?
11/24/2018 8:22 PM
Identification in Real Life Works Pretty Well …How Do We Do That?
Externalizes
Authentication
Gets user info from the document
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Claims Can Set Your Application Free
11/24/2018 8:22 PM
Claims Can Set Your Application Free
Identity Provider
Active Directory
Federation Services 2.0
STS
Claims
Relying Party
Security Token
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. Claims Based Identity: it’s EASY!
11/24/2018 8:22 PM
Claims Based Identity: it’s EASY!
demo
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. Essential claims programming model
11/24/2018 8:22 PM
Essential claims programming model
Claims OM integrated with the .NET identity API
Single programming model for ASP.NET & WCF
Config driven
Single programming model for on-premises & cloud
Tools for metadata-driven automatic app configuration
WS-Federation, WS-Trust
Framework for custom STS development
And more…
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Windows Identity Foundation Object Model
void Page_Load(object sender, EventArgs e) {
IClaimsPrincipal icp = (IClaimsPrincipal)
Thread.CurrentPrincipal;
IClaimsIdentity claimsIdentity =
(IClaimsIdentity)icp.Identity;
ageClaimValue = (from c in claimsIdentity.Claims
where c.ClaimType == "
select c.Value ).Single(); }
Claim
IClaimsIdentity
IClaimsPrincipal
Subject
Claims
Identities
Issuer
Claim
IClaimsIdentity
OriginalIssuer
Delegate
ClaimType
IIdentity
AuthenticationType
IsAuthenticated
Name
IPrincipal
IsInRole
Value
Identity
ValueType

9. Windows Identity Foundation Visual Studio Integration
11/24/2018 8:22 PM
Windows Identity Foundation Visual Studio Integration
Tools for establishing and maintaining trust
VS templates for claims-aware websites and services
Ready-to-use ASP.NET controls
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Windows Identity Foundation HttpModules
11/24/2018 8:22 PM
Windows Identity Foundation HttpModules
HTTPModule(s) in the ASP.NET pipeline of the app
They take care of exposing policy, manage protocol redirects, establish sessions…
WSFederationAuthenticationModule
Implements the WS-Federation redirects protocol
SessionAuthenticationModule
Takes care of handling sessions (regardless of the sign-in protocol)
ClaimsPrincipalHttpModule
Provides a hook for injecting claims in the current principal
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. 11/24/2018 8:22 PM
Fabrikam Shipping: - Basic Authentication Externalization - Claims Consumption
demo
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. WIF ASP.NET Processing Pipeline
11/24/2018 8:22 PM
WIF ASP.NET Processing Pipeline
WSFAM
SecurityTokenHandler
ClaimsAuthenticationManager
SessionAuthenticationModule
ClaimsAuthorizationManager
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. WIF & Authorization ASP.NET roles will work “as is”
11/24/2018 8:22 PM
WIF & Authorization
ASP.NET roles will work “as is”
IsInRole, <authorization> element
Any incoming claim type can be used as role
Claims authorization can be much more sophisticated that RBAC
Age thresholds, dates, spending limits…
WIF offers a hook for your authZ logic
ClaimsAuthorizationManager class
Provide your implementation of CheckAccess
Add it in the WIF pipeline via config
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. WIF and WCF Initializing the WIF Pipeline in WCF
11/24/2018 8:22 PM
WIF and WCF Initializing the WIF Pipeline in WCF
Same programming model as ASP.NET…
…different hosting architecture
Self-Hosted services:
Call FederatedServiceCredentials.ConfigureServiceHost(host) on your ServiceHost before Opening it
Web activated services:
Derive a new factory from ServiceHostFactory
Override CreateServiceHost and use the above ConfigureServiceHost call in it
Use your custom factory in directive of your .svc file
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. WIF and WCF WIF Bindings
11/24/2018 8:22 PM
WIF and WCF WIF Bindings
UserNameWSTrustBinding
CertificateWSTrustBinding
WindowsWSTrustBinding
KerberosWSTrustBinding
IssuedTokenWSTrustBinding
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Fabrikam Shipping: - Authorization - WIF & WCF Services
11/24/2018 8:22 PM
Fabrikam Shipping: - Authorization - WIF & WCF Services
demo
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. Developing an STS with WIF
11/24/2018 8:22 PM
Developing an STS with WIF
WIF provides building blocks for custom STS development
AD FS 2.0 is built with WIF!
Same programming model for all hosting options
Active: WCF
Passive: ASP.NET
Wizards & Templates create a skeleton STS in no time
Perfect for testing purposes
Main activities
Decide who to trust
Decide which kind of credentials you’ll accept
Provide all the cryptographic material for signing & encrypting
Hook in the logic for retrieving claim values
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Delegation: Flowing Identity Through Tiers
11/24/2018 8:22 PM
Delegation: Flowing Identity Through Tiers
STS
STS
Frontend
Backend
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Fabrikam Shipping: - Custom STS - Delegation
11/24/2018 8:22 PM
Fabrikam Shipping: - Custom STS - Delegation
demo
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

20. We Barely Scratched the Surface…
TrustChannel
WIF SAML2N
Advanced session management
Step-up authentication
Web farms
Windows Azure …

21. Identity @ PDC 2009 Come visit us at the booth in the pavilion!
11/24/2018 8:22 PM
PDC 2009
Come visit us at the booth in the pavilion!
Try a hands on lab
Introduction to Windows Identity Foundation
Using WIF to Secure Windows Azure Applications
Attend identity sessions
SVC28: System.Identity Model Accessing Directory Services
PR11: Leveraging & Extending SharePoint Identity Features
SVC26: How Microsoft SharePoint 2010 was Built with WIF
SVC17: Enabling SSO to Windows Azure Applications
SVC02: Windows Identity Foundation Overview
SVC19: REST Security Services in Windows Azure using the Access Control Service
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Free your applications…
11/24/2018 8:22 PM
Summary
Claims-base identity simplifies authentication, authorization and customization for your apps
WIF makes easy for .NET developers to program with claims
Free your applications…
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. YOUR FEEDBACK IS IMPORTANT TO US!
Please fill out session evaluation forms online at
MicrosoftPDC.com

24. channel9.msdn.com/learn
11/24/2018 8:22 PM
Learn More On Channel 9
Expand your PDC experience through Channel 9.
Explore videos, hands-on labs, sample code and demos through the new Channel 9 training courses.
channel9.msdn.com/learn
Built by Developers for Developers….
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. 11/24/2018 8:22 PM
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. 11/24/2018 8:22 PM
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.