You can find the code source here : https://bitbucket.org/rachkoud/hardcoded-token/wiki/Home

I keeps forcing me to map service name to object that is implemented as the code behind for the svc file.
I keep getting this error:
Service ‘System.ServiceModel.Security.WSTrustServiceContract’ has zero application (non-infrastructure) endpoints. This might be because no configuration file was found for your application, or because no service element matching the service name could be found in the configuration file, or because no endpoints were defined in the service element.

Hope that makes sense.

- Pat

Create a SecurityTokenDescriptor to describe your token, use that to feed the saml security token handler CreateToken method.

Then use WriteToken and turn the result into a GenericXmlSecurityToken. That token can then be used to with CreateChannelWithIssuedToken.

I followed your courses on PluralSight and you’ve done a great job, I highly recommand them. I’m in the process of securing my WCF services and before installing an STS in our environment, I would like to send an hardcoded token, I can’t find a piece of code to do that, I would like to use the same code as above except that create my hardcoded token instead of request it, like this :

…
var myHarded = .. // How can I create this token? That will be valid on the server side with the same server config as above (audienceUris, issuerNameRegistry, ..), also a bearer token.

// create channel with specified token
var proxy = factory.CreateChannelWithIssuedToken(myHardedToken);

var id = proxy.GetIdentity();

How can I do that?

Thanks
Rasheed

I notice that in .Net 3.5 we could implement
<service name="Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract"
in the web.config towards implementing an ActiveSTS

I think we cant do that anymore in .Net 4.5. How does one go about implementing something similar in .Net 4.5?

Thanks
Pat

IdentityServer has all you need – look for the service host factory in the WS-Trust folder of the Protocols project.

I have looked at the thinktecture project and that is way more extensive than a simple sample. I have also seen all your pluralsight videos but I dont think there is a description of developing Active STS.

I have setup an Active STS but I keep getting the error

The message with Action ‘http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/SCT’ cannot be processed at the receiver, due to a ContractFilter mismatch at the EndpointDispatcher. This may be because of either a contract mismatch (mismatched Actions between sender and receiver) or a binding/security mismatch between the sender and the receiver. Check that sender and receiver have the same contract and the same binding (including security requirements, e.g. Message, Transport, None).

Any ideas where to look?
Thanks
Pat

http://msdn.microsoft.com/en-us/library/dn205065.aspx
http://www.cloudidentity.com/blog/2012/11/20/introducing-the-developer-preview-of-the-json-web-token-handler-for-the-microsoft-net-framework-4-5-2/

Thanks for your your reply. Can you please share any Sample in which you explain how you are generating Json Web Token using ThinkTecture? Please guide me may be I am wrong. As per my understanding after looking in to your library, you are using ACS internally. You are generating Json Web token using OAuth class. Please suggest any better way to generate Json Web Token using ThinkTecture.

Thanks!

Karel

please use the issue tracker
https://github.com/thinktecture/Thinktecture.IdentityModel.40/issues

In general I’d recommend using .NET 4.5 since we actively maintain that version.

xhrFields: {
withCredentials: true
}

I would recommend to use the JWT token format instead of SWT – SWT is dead.

On Nuget there is a JWT authorization manager for WCF (search for JWT).

Consider just two event button click and two controller action (a little bit of code ) :
https://gist.github.com/tomadj/7ed5642f65f9329c5ff5

IF the code client is in the same server ( IIs localhost visualstudio 2012 project MVC 4 + webAPI ) run from on a razor page html –> http://localhost:5314/home/index :

1 ) click on “is Authorize ?” button –> return 401 Unauthorized
2 click on “login” button –> return success: true
3) click again on is Authorize ? button –> return OK user is authentificated

however if I call my web api from an other server/site (in my case, a wordpress blog in a html page of this blog ) :

1 ) click on “is Authorize ?” button –> return 401 Unauthorized
2 click on “login” button –> return success: true
3) click again on is Authorize ? button –> RETURN 401 UNAUTHORIZED

I guess :
1- I must get the “context/cookie” in the callback of action login if return true.
2- I must set the “context/cookie” before call again the authorize action

No ?
if is the good solution, can you help me for do that ?

Thank’s again !

Thomas

An old posts. But since I am writing about AuthenticationHandler..this is still relevant!

Is the source code available from your video: http://vimeo.com/43603474?

Please read up on cookies and how forms authentication is supposed to work. Otherwise I can’t help you.

Server side :
- In the LogUser Action, if the user is validate I set the AuthCookie with : FormsAuthentication.SetAuthCookie(user.Login, true);

I remove just the lines : authentication.AddBasicAuthentication((username, password)
=> Membership.ValidateUser(username, password)); in AuthenticationConfiguration ?

And client side, must be added in the header of the ajax request to the [Autorize] action the cookie. How can I do that ?

1) I think not, because I remove FormsAuthentication.SetAuthCookie(user.Login, true);
I thought you told me that it’s for form based auth.

2) For round-trip, I don’t understand. :(

So, already, is that we agree on the method? me I have to, in my case (webapi), the basic auth and not form based auth ?

I read again your post http://leastprivilege.com/2012/10/23/mixing-mvc-forms-authentication-and-web-api-basic-authentication/

effectively, in the sample, in the client , there are :
client.DefaultRequestHeaders.Authorization =
new BasicAuthenticationHeaderValue(“alice”, “alice”);

Me, I must do the equivalent in my ajax request to the authorize action ?? .

and also, for the time being, my action LogUser return just true if the user is validate. it is at this level that I need to do something else ? (in reference to the round trip maybe ?)

- Is the forms auth cookie being set when you call the login method?
- Is it round-tripped from that point on?