Category Archives: ASP.NET

Using the .NET Access Control Service with Geneva

Posted on December 11, 2008 by Dominick Baier

If you haven’t checked out the .NET Access Control Service yet – I can highly recommend it! Justin did two talks about it at PDC: Access Control Service in .NET Services  Access Control Service Drilldown In the 2nd talk Justin … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

LeastPrivilege.IdentityModel v2

Posted on December 7, 2008 by Dominick Baier

Looking at the download numbers, my add-on library for System.IdentityModel was quite popular. Some days ago I started looking the code to see what could be still useful in the face of Geneva. The good news is, that a lot … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

(SAML) Token Creation in a Geneva STS

Posted on November 22, 2008 by Dominick Baier

By default, Geneva STS developers are quite shielded from the SAML creation process – you simply derive from SecurityTokenService and implement GetScope and GetOutputClaimsIdentity, and the rest gets done by the framework. But if you need more control over the … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

Geneva HTTP Modules: ClaimsPrincipalHttpModule

Posted on November 17, 2008 by Dominick Baier

Geneva ships with three HTTP modules to use with ASP.NET: ClaimsPrincipalHttpModule, SessionAuthenticationModule and WSFederationAuthenticationModule. What are they for – and when to chose which? In this post I will focus on the simplest one of the three: ClaimsPrincipalHttpModule – in … Continue reading →

Posted in ASP.NET, IdentityModel | Leave a comment

ClaimsAuthenticationManager in Geneva

Posted on November 14, 2008 by Dominick Baier

One of the things that Zermatt was lacking was a uniform way to look at incoming claims (either from an STS or from auto-converted authentication information). In Geneva we now have a piece of plumbing called the ClaimsAuthenticationManager which gets … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

Geneva is the new Zermatt (and much more)

Posted on October 27, 2008 by Dominick Baier

Starting with the PDC release, Microsoft’s identity framework is now code-named “Geneva Framework”. Based on that framework, there is also a product called “Geneva Server” that brings the ADFS 1.x type of functionality (and more) to the web services/WS-Trust/CardSpace world. … Continue reading →

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

ASP.NET Controls and Output Encoding

Posted on September 10, 2008 by Dominick Baier

The last two days I did an ASP.NET security training for a customer. One discussion was how ASP.NET control handle (or don’t) output encoding – especially how inconsistent their behavior is. Five minutes ago I found this post by Alex … Continue reading →

Posted in ASP.NET | Leave a comment

Custom Basic Authentication is now on Codeplex

Posted on April 19, 2008 by Dominick Baier

I also moved my “Basic Authentication against non-Windows accounts for IIS” (phew) project to Codeplex http://www.codeplex.com/CustomBasicAuth Again, if you have feature ideas or want to contribute, contact me.  

Posted in ASP.NET, WCF | 2 Comments

InfoCardSelector is now on Codeplex

Posted on April 16, 2008 by Dominick Baier

I finally found a new home for my ASP.NET InfoCard control: http://www.codeplex.com/InfoCardSelector If you feel like contributing or suggesting new features, you can contact me via this page.

Posted in ASP.NET, IdentityModel, WCF | Leave a comment

Developing ASP.NET Applications in Medium Trust

Posted on April 12, 2008 by Dominick Baier

Alex Smolen did a good write up of the various approaches for sandboxing ASP.NET applications. Recommended!

Posted in ASP.NET | Leave a comment