1. Claims-based security with Windows Identity Foundation

2. Goals Introduce you to claims-based security. Show that it isn’t that hard anymore, thanks to WIF. And it’s fun!

3. Some terminology

4. Two types of federation WS-Federation: Active Requestor Profile - Based on WS-Trust - For active clients, such as WPF and WinForm applications WS-Federation: Passive Requestor Profile - Based on WS-Federation - For web clients - "emulating" WS-Trust on top of GET, POST, browser redirects and cookies

5. Claim Way too abstract: A statement that is made by one entity about another entity. Let’s make it a bit more concrete: A piece of information about a user in a system, issued by a security token service (STS) that a claims-aware application trusts: Name EmailIdentifying claims Phone Number Nationality Age Blind claims Hair color Role, permission

6. What’s inside a claim? ClaimTypeBuilt-in: name, email, phonenumber Custom: organization number, cost center, member status …or anything else that makes sense in your system Usually they have a URI-format, such as: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname” ClaimValue e.g.: “john.doe@somewhere.com” Issuer (STS) “CN=the.sts.at.somewhere.com”, the name of the STS that has issued the claim And a couple of more properties: ClaimValueType, OriginalIssuer,...

7. So from a security point of view we can say that a user’s identity is made up by a set of claims

8. Security token Claims on the wire I.e., a serialized set of claims - digitally signed by the STS -encrypted (optional but recommended) Security token formats: SAML - an XML-based standard from OASIS - is the most common format - Interoperable Kerberos X.509 certificate

9. Basic rules of Claims-based authorization Let go of authentication the users yourself. Let the STS handle it instead. Establish a trust relationship with the STS

10. The driving forces It enables identity federation It enables SSO Lower user administration costs for organizations Always fresh user information Seamless step-up authentication Separation of concerns Better security

11. What about role-based access control? Don’t worry... It’s backward compatible!

12. Active client IP-STS Application = RP Application = RP AD Trust relationship RST - Credentials - AppliesTo RSTR - Security token - Proof key Claims Gather claims Authenticate Validate AppliesTo Claims based security – One domain RP = Relying Party A.K.A.: - Claims-aware application - Service provider Example: WCF Service E.g.: WPF, WinForm A.K.A.: - STS E.g.: ADFS 2.0 RPs Delivers credentials E.g.: - Username / Pwd - Windows credentials - Certificate Response Msg + token WCF pipeline IP = Identity Provider

13. WPF Client RP-STS WCF Service http://domain/service1 WCF Service http://domain/service1 trusts Transformation rules Federated identity Authenticate Issue token Security Domain A Security Domain B trusts Send Token Issue new token IP-STS Send message + token Send response

14. Active Client Certificates Security Domain A IP-STS CertificateStore locationPurpose IP:STS:s private keyLocal Computer/PersonalSign token RP.STS:s public keyLocal Computer/PersonalEncrypt token SSL CertificateLocal Computer/PersonalSecure the channel Root atuhority certificateTrusted Root Certificate Auth. Create SSL certificate CertificateStore locationPurpose RP:s public keyBase64 encoded in app.configEncrypt message and authenticate RP IP-STS:s SSL public keyLocal Computer/Trusted People Secure the channel Proof key from RP.STSSign the message to RP

15. RP-STS RP Certificates Security Domain B CertificateStore locationPurpose IP:STS:s public keyLocal Computer/Trusted People Validate signature RP STS:s private keyLocal Computer/PersonalDecrypt incoming token and Sign issued token RP:s public keyLocal Computer/ Trusted People Encrypt token CertificateStore locationPurpose RP:s private keyLocal computer/PersonalDecrypt token RP.STS:s public keyLocal Computer/Trusted People Validate RP-STS:s signature

16. Certificates Certificate Authority VeriSign Self-signed test certificates – during development makecert.exe

17. WIF A framework for building claims-based applications as well as STS:s An abstraction layer over the WS-Trust and WS-Federation It contains - a set of.NET classes inside Microsoft.IdentityModel - Visual Studio project templates for ASP.NET, WCF applications and STS services - ASP.NET controls, e.g. FederatedPassiveSignInControl - FedUtil, a tool that makes it easy to establish trust between the application and the STS

18. You need this get started: Visual Studio 2008 /2010 WIF WIF SDK, includes guidelines, samples etc.

19. Demo