Introduction to Identity and Access Control in .NET 4.5

Posted on June 21, 2012 by Dominick Baier

I am working together with PluralSight on creating a full fledged curriculum around identity & access control for .NET and Windows.

This will include training material around core .NET identity (aka WIF 4.5), ASP.NET web applications, WCF services and ASP.NET Web API (and some other interesting ‘stuff’ ;))

In addition we are planning to create a number of fundamental course for crucial topics like X.509 certificates, protocols and tokens. So stay tuned!

The first course is now live: “Introduction to Identity and Access Control in .NET 4.5”.

It covers basics around IIdentity, IPrincipal. Claim, ClaimsIdentity and ClaimsPrincipal and introduces additional concepts like claims transformation, claims authorization and third party authentication.

I hope this is useful!

This entry was posted in .NET Security, Conferences & Training, IdentityModel, WebAPI. Bookmark the permalink.

2 Responses to Introduction to Identity and Access Control in .NET 4.5

Rich says:

July 12, 2012 at 17:22

Dominick, first of all – just watched your PluralSight video on this and it was excellent!

I have question about direction, though. I have a standard .NET Web Application that is currently using Forms Authentication with custom username and password database management that I have to still support. Now, I need to ALSO add in WIF 4.5 to support federated logins as an additional authentication option. Can you describe the path I should be going down for doing this at a high-level? I’ve been reading up on Relying Party and Passive STS and I’m thinking this is the only way I’ll be able to accomplish what I’m trying to do but I wanted to confirm.

So, to sum it up – can I mix in STS login and normal Forms Authentication in the same Web application to where I can have a page in my site that checks what kind of authentication is required (Forms or WIF) and then based on some logic, serve up a login page or redirect them to an STS after figuring that out programmitically?

Help me, Obi-Wan, you’re my only hope! :)

Rich

Reply
- Dominick Baier says:
  
  July 12, 2012 at 17:32
  
  Thanks!
  
  Have a look here:
  https://leastprivilege.com/2012/02/02/mixing-forms-and-token-authentication-in-a-single-asp-net-application/
  https://leastprivilege.com/2012/02/02/mixing-forms-and-token-authentication-in-a-single-asp-net-application-the-details/
  
  There is also the RedirectToIdentityProvider event on the ws fed module that gives you some control.
  
  Reply