MSDN Magazine - October 2008 - (Page 73) Figure 8 Checking Claims Authorization public void PlaceOrder(Order order) { int purchaseLimit = GetPurchaseLimit(); if (Order.Total > purchaseLimit) { // do appropriate action } } private int GetPurchaseLimit() { AuthorizationContext context = ServiceSecurityContext.Current.AuthorizationContext; foreach (ClaimSet set in context.ClaimSets) { foreach (Claim claim in set.FindClaims( Constants.PurchaseLimitClaimType, Rights.PossessProperty)) { return int.Parse(claim.Resource.ToString()); } } throw new Exception(‘Claim not found’); } Guerrilla .NET: w/ 3.0 & 3.5 content November 3rd-7th London Call 800.699.1932 to register today! or visit www.develop.com New Hands-on .NET 3.0/3.5 Training What’s New in .NET 3.0-3.5 w/LINQ October 6th - Boston Security Token Services A security token service (STS) is a tool that allows further consolidation of security logic. The typical task of an STS is to authenticate users and create a security token that, in turn, can contain claims. Clients must first authenticate with the STS and then forward the returned token to the service with which the client wants to communicate. Since the STS knows about that service (this information is part of the token request), it can do central authorization as well as pregenerate the claims on which the service relies. This way the claims transformation does not need to happen on the service endpoint at all but can be done centrally by the STS. This can dramatically streamline your security infrastructure when your system reaches a certain level of complexity. A security token service is also an important infrastructure component when it comes to federating multiple trust domains. By establishing trust between several token services, you can exchange security tokens over the trust boundary that can be used by services. WCF has automatic client/service-side support for the previous scenario as well as all the base classes needed to write an STS. But correctly implementing all the related WS-* specs is a complicated task. Instead, you should either buy a commercial STS or use a higher-level toolkit, such as Zermatt, to write a custom one. The upcoming version of Microsoft Active Directory Federation Services is designed to be a full-featured STS for WCF. T DOMINICK BAIER is a security consultant at thinktecture (www.thinktecture.com) in Germany. In addition, he is the security and WCF curriculum lead at DevelopMentor (develop.com), a developer security MVP, and the author of Developing More-Secure Microsoft ASP.NET 2.0 Applications. You can find his blog at leastprivilege.com. Windows Communication Foundation w/ 3.5 content October 13th - Los Angeles November 3rd- Chicago November 17th- New York Windows Presentation Foundation w/ 3.5 content October 13th - Los Angeles November 10th - Austin Windows WorkFlow Foundation November 3rd - Los Angeles NEW COURSE Essential Skills for the Business Analyst October 29th - Los Angeles On-Site Training For groups of students, DevelopMentor’s On-Site course delivery may offer the most cost-effective solution – at your location, at the time you need it. OnSites also offer the ability to customize a course to your group’s needs, including course content, labs that run on your programming platform and lab exercises tailored to your business or project. Call us today to discuss your training needs! US -800.699.1932 UK -(0)8000.562.265 Europe-(0)01242.525.108 CHRISTIAN WEYER is cofounder and principal architect of thinktecture and has been modeling and implementing distributed applications with Java, COM, DCOM, COM+, Web Services, WCF, and other technologies. Get in touch with him at www.thinktecture.com/staff/christian. msdnmagazine.com October 2008 73 http://www.develop.com http://www.develop.com http://www.thinktecture.com http://www.develop.com http://www.leastprivilege.com http://www.thinktecture.com/staff/christian http://www.msdnmagazine.com
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.