MSDN Magazine - January 2009 - (Page 71)

HTTPS Redirect SignIn Web.con g Login.aspx Default.aspx FormsAuthenticationModule SignOut Login Control FederatedPassiveTokenService Control CustomSTS Figure 11 Implementation Architecture for a Passive STS Using Forms Authentication Custom SecurityTokenServiceCon guration obvious differences in how the passive STS handles authentication and in how the underlying STS functionality is invoked. The diagram in Figure 10 illustrates these differences from a high level. The passive STS is implemented as a Web site that requires SSL encryption to secure the token issuance process. The default page (Default.aspx) hosts a control that facilitates communication with the underlying custom STS, which is configured just like an active STS. The STS site must authenticate the caller prior to token issuance, and this is where classic ASP.NET configuration comes into play for authentication and authorization. In Figure 11, the STS application is configured for Forms authentication, so requests are redirected to a login page (Login.aspx) if they have not yet been authenticated by the FormsAuthenticationModule. A passive STS can share the same core STS implementation as an active STS—with one minor change. In the GetScope override (shown in Figure 5) a passive STS must set the ReplyToAddress property so that the STS can redirect after issuing the token. Usually this is set to the default page for the RP, based on the AppliesTo address supplied with the RST: Scope scope = new Scope(request); scope.ReplyToAddress = scope.AppliesToAddress + "/default.aspx"; // other scope settings and set its Service property to the custom SecurityTokenServiceConfiguration implementation as follows: The control requires that the user is authenticated and checks this in its PreRender event. It is expected that the STS site is configured appropriately to ensure that users are redirected elsewhere to authenticate prior to reaching this default page. As long as authenticated users are always directed to this default page, no other configuration is required to process requests. The control also provides the Error, PreSignInRequested, PostSignInRequested, PreSignOutRequested, and PostSignOutRequested events to handle exceptions, and to hook sign-in and sign-out requests. SessionAuthenticationModule As an alternative to the FederatedPassiveTokenService control, you can programmatically enable passive STS functionality. First enable federated authentication in the configuration section: The Geneva Framework configuration for a passive STS is no different from an active STS. A SecurityTokenServiceConfiguration type is used to initialize the STS (shown in Figure 7), and any relevant settings in the configuration section are also considered. Next, enable the federation module for a passive STS, the SessionAuthenticationModule from the Microsoft.IdentityModel.Web namespace: FederatedPassiveTokenService Control The Geneva Framework provides a control that implements the required functionality of a passive STS. That is, it processes sign-in and sign-out HTTP requests, converting each request into an RST and then invoking the underlying STS implementation. The control also processes RSTR responses and handles redirection to the RP, and writing the session cookie for authenticated callers. Place this control on the default page for the passive STS site msdnmagazine.com This produces the same result as the FederatedPassiveTokenService control for requests sent to any page in the STS Web site. The module redirects unauthenticated callers to the login page. Upon successful login, callers are redirected to the STS page originally requested. This programmatic approach gives developers additional control beyond that provided by the FederatedPassiveTokenService control. For example, the module exposes the following events to January 2009 71 http://www.msdnmagazine.com

Table of Contents Feed for the Digital Edition of MSDN Magazine - January 2009

Toolbox CLR Inside Out Basic Instincts Cutting Edge Test Run First Look� Geneva Framework Silverlight Windows Mobile Service Station Security Briefs Extreme ASP.NET Foundations .NET Matters { End Bracket }

MSDN Magazine - January 2009

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.