Monthly Archives: July 2009

WCF Source Code for Download

Posted on July 30, 2009 by Dominick Baier

http://referencesource.microsoft.com/netframework.aspx

Posted in WCF | Leave a comment

Claims Authorization in WIF Beta 2 – ASP.NET and WCF Integration

Posted on July 22, 2009 by Dominick Baier

In the previous post I illustrated how the basic claims authorization infrastructure in WIF (formerly Geneva) works. In this post I want to focus more on how claims authorization behaves when integrated in WCF and ASP.NET. ASP.NETIn addition to using … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

Claims Authorization in Geneva Beta 2 – Introduction

Posted on July 10, 2009 by Dominick Baier

I guess you already heard the term “claims based authorization” several times by now. But how exactly does the authorization work? The typical pattern is that you iterate through the claims associated with the user and search for a special … Continue reading →

Posted in Uncategorized | Leave a comment

Defeating SSL

Posted on July 10, 2009 by Dominick Baier

Not a really new paper – but definitely recommended reading. Some lessons learned: Moxie is not really attacking SSL – but uses HTTP to bypass HTTPS. Switch to SSL as early as possible – but that might be too late … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

A closer look at Sandboxing in (ASP.NET) V4

Posted on July 3, 2009 by Dominick Baier

In the last two posts I described how ASP.NET uses the homogenous AppDomain model to implement partially trusted apps. In ASP.NET you use the combination of a trust level (aka grant set) and a list of full trust assemblies to … Continue reading →

Posted in ASP.NET | Leave a comment

Identity Metasystem Interoperability Version 1.0

Posted on July 2, 2009 by Dominick Baier

The IMI spec is now approved. Grats! Read more here and get the spec here.

Posted in IdentityModel | Leave a comment

Partial Trust ASP.NET in 4.0 (Advanced Scenarios)

Posted on July 1, 2009 by Dominick Baier

In the last post I showed you how to use the new CLR security model to do sandboxing in ASP.NET. One new hook into this system is a custom host security policy resolver. A policy resolver is a class that … Continue reading →

Posted in ASP.NET | Leave a comment