1. Windows Communications Foundation ("Indigo"): Writing Secure Distributed Applications Martin Gudgin COM312 Program Manager Microsoft Corporation

2. Agenda WCF Security Model Credentials Security modes Authorization

3. ConfidentialityIntegrityAuthenticationAuthorization Security Requirements

4. WCF Security Model Based on credentials Satisfies security requirements Secure by default Consistent across bindings

5. Credentials Provide claims Basis of satisfying security requirements

6. Credential Examples Alice MyDomain\Alice Subject: CN=Alice Issuer: SomeCA ValidFrom: 2005-09-13 ValidUntil: 2005-09-16 Username Kerberos Certificate

7. Transport Credentials Security requirements satisfied at transport layer Performance benefits Restricted claim types

8. Transport Credentials

9. Message Credentials Security requirements satisfied at message layer Claims carried in messages More credential types, extensible

10. Message Credentials

11. Mixed Mode Integrity and confidentiality requirements satisfied by transport layer Claims carried at message layer More credential types, extensible

12. Mixed Mode

13. Secure Sessions Setting up a secure session improves performance Transport independent, secure across multiple hops Simple message level claims Associated with claims from bootstrap

14. Secure Session

15. Federated Credentials Issued by third party Based on provided credentials Supports arbitrary credentials

16. Federated Credentials Service Credential Issuer Client I’m Bob (X.509) Here’s a Credential (SAML) I’m Bob (SAML) Trust Relationship

17. Federated Credentials

18. Auditing Various security events are audited Supports auditing of success and failure Configurable

19. Audit Records

20. Authorization Claims used to determine access Integrates with CLR PrincipalPermission Provides new OperationRequirement mechanism Extensible

21. Authorization

22. Where Are We? Communication is secure by default It’s all about claims Many credential types supported Consistent across bindings It’s all extensible – see COM430

23. Community Resources At PDC For more information, go see COM321 - "InfoCard": Developing Federated Identity Applications Using "InfoCard" and the WCF (Thu 11:30am) COM430 - Windows Communications Foundation: A Deep Dive into Extensions for Security and Identity (Fri 8:30am) COM432 - Developing Web Services Using ASP.NET and WSE That Interoperate with the WCF (Fri 8:30am) Ask The Experts table: WCF Security COM Track lounge After PDC MSDN dev center: http://msdn.microsoft.com/webservices/ http://msdn.microsoft.com/webservices/ MSDN Forums Channel 9 tag: http://channel9.msdn.com/tags/Indigo

24. © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.