MSDN Magazine - January 2009 - (Page 70)

Figure 8 Config for an STS Figure 9 A Custom UserNameSecurityTokenHandler public class CustomUserNameSecurityTokenHandler: UserNameSecurityTokenHandler { public override ClaimsIdentityCollection ValidateToken(SecurityToken token) { UserNameSecurityToken userNameToken = token as UserNameSecurityToken; AuthenticateUser(userNameToken.UserName, userNameToken.Password); return new ClaimsIdentityCollection(new IClaimsIdentity[] { new ClaimsIdentity( new Claim(System.IdentityModel.Claims.ClaimTypes.Name, userNameToken.UserName), "CustomUserNameSecurityTokenHandler")}); can be registered to process requests for their respective credential type. If the STS endpoint expects a UserName credential, the default UserNameSecurityTokenHandler registered is the WindowsUserNameSecurityTokenHandler. Figure 8 illustrates the removal of WindowsUserNameSecurityTokenHandler and the addition of MembershipUserNameSecurityTokenHandler as its replacement— including related config settings for the membership provider. You can also create custom SecurityTokenHandler types. Remember, as long as they derive from the appropriate base class matching the token category (such as UserNameSecurityTokenHandler), you can replace the default handler with the new custom handler. Figure 9 illustrates a custom UserNameSecurityTokenHandler implementation named CustomUserNameSecurityTokenHandler. At a minimum, ValidateToken and CanValidateToken must be overridden in the custom SecurityTokenHandler implementation. Inside ValidateToken you are responsible for authenticating against the appropriate credential store. The results of that authentication should be a set of claims that can be returned to the runtime to be attached to the ClaimsPrincipal for the request thread. It is also very important to override CanValidateToken and return True. Without this override, the token handler will not be registered in the collection and it will never be invoked. In a simple passive federation scenario, the same participants are present, as shown in Figure 3, for an active federation scenario— except that the client is a browser, the RP is a Web application, and the IP-STS is also fronted by a Web application to handle HTTPbased communication. Figure 10 illustrates the participants and flow of communication for passive federation. The moving parts behind this scenario are similar to those shown in Figure 4, as far as the core STS is concerned, but there are some Building a Custom Passive STS } } public override bool CanValidateToken { get { return true; } } curity token handlers for authentication and issuance, a claims authentication manager, an issuer name registry, and token resolvers. Figure 8 shows a few useful settings configured for an STS. A custom ClaimsAuthenticationManager type is invoked for non-Windows credentials giving the option to supply a custom ClaimsPrincipal type to the runtime prior to issuing claims in GetOutputClaimsIdentity. Custom security token handlers might be configured to supply settings that override the default behavior of a particular handler or to alter the choice of security token handler for a particular credential type. User Browser 3 Authenticate/ Authorize 2 Issue Token Security Token Handlers 1 Authenticate You probably expect a service behavior configuration to determine how authentication and authorization will take place for each STS endpoint. Recall from my last article that the Geneva Framework does things a little differently. In the case of authentication, the collection specifies the SecurityTokenHandler types available to authenticate incoming requests. This collection can only contain one entry for each SecurityTokenHandler type. For example, only one KerberosSecurityTokenHandler, UserNameSecurityTokenHandler, X509SecurityTokenHandler, Saml11SecurityTokenHandler, or Saml2SecurityTokenHandler 70 msdn magazine RP Web Application Trust IP-STS Web Application IP-STS Service Figure 10 A Simple Federation Scenario with a Single RP and a Passive IP-STS Geneva Framework

Table of Contents Feed for the Digital Edition of MSDN Magazine - January 2009

Toolbox CLR Inside Out Basic Instincts Cutting Edge Test Run First Look� Geneva Framework Silverlight Windows Mobile Service Station Security Briefs Extreme ASP.NET Foundations .NET Matters { End Bracket }

MSDN Magazine - January 2009

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.