Category Archives: IdentityModel

Sample Relying Party for Thinktecture.IdentityServer

Posted on July 6, 2011 by Dominick Baier

I uploaded a sample RP for IdentityServer. It shows some basic things like connecting a web application via WS-Federation and a SOAP service via WS-Trust.

Posted in IdentityModel, IdentityServer | 5 Comments

Access Control Service: Passive/Active Transition Sample

Posted on June 23, 2011 by Dominick Baier

Here you can find my updated ACS2 sample. In addition to the existing front ends (web [WS-Federation], console [SOAP & REST], Silverlight [REST]) and error handling, it now also includes a WPF client that shows the passive/active transition with a … Continue reading →

Posted in Azure, IdentityModel | 4 Comments

Access Control Service: Programmatically Accessing Identity Provider Information and Redirect URLs

Posted on June 23, 2011 by Dominick Baier

In my last post I showed you that different redirect URLs trigger different response behaviors in ACS. Where did I actually get these URLs from? The answer is simple – I asked ACS ;) ACS publishes a JSON encoded feed … Continue reading →

Posted in Azure, IdentityModel | Leave a comment

Access Control Service: Transitioning between Active and Passive Scenarios

Posted on June 22, 2011 by Dominick Baier

As I mentioned in my last post, ACS features a number of ways to transition between protocol and token types. One not so widely known transition is between passive sign ins (browser) and active service consumers. Let’s see how this … Continue reading →

Posted in Azure, IdentityModel | Leave a comment

Access Control Service: Protocol and Token Transition

Posted on June 22, 2011 by Dominick Baier

ACS v2 supports a number of protocols (WS-Federation, WS-Trust, OpenId, OAuth 2 / WRAP) and a number of token types (SWT, SAML 1.1/2.0) – see Vittorio’s Infographic here. Some protocols are designed for active client (WS-Trust, OAuth / WRAP) and … Continue reading →

Posted in Azure, IdentityModel | Leave a comment

Updates for Thinktecture.IdentityModel

Posted on June 17, 2011 by Dominick Baier

I just uploaded a new version to codeplex and nuget (Thinktecture.IdentityModel). Besides some bug fixes and clean up I added the ProtectedCookie feature and some more extension methods.

Posted in IdentityModel | Leave a comment

Useful Extensions for SecurityToken Handling – Convert a SecurityToken to Claims

Posted on June 17, 2011 by Dominick Baier

That’s a very common one: public static IClaimsPrincipal ToClaimsPrincipal( this SecurityToken token, X509Certificate2 signingCertificate){    var configuration = CreateStandardConfiguration(signingCertificate);    return token.ToClaimsPrincipal(configuration.CreateDefaultHandlerCollection());}   public static IClaimsPrincipal ToClaimsPrincipal(this SecurityToken token, X509Certificate2 signingCertificate, string audienceUri){    var configuration = CreateStandardConfiguration(signingCertificate);     configuration.AudienceRestriction.AudienceMode = AudienceUriMode.Always;    configuration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(audienceUri));     return token.ToClaimsPrincipal(configuration.CreateDefaultHandlerCollection());}   public static IClaimsPrincipal ToClaimsPrincipal( … Continue reading →

Posted in IdentityModel | Leave a comment

Protecting Cookies: Once and For All

Posted on June 1, 2011 by Dominick Baier

Every once in a while you run into a situation where you need to temporarily store data for a user in a web app. You typically have two options here – either store server-side or put the data into a … Continue reading →

Posted in ASP.NET, IdentityModel | Leave a comment

Access Control Service: Handling Errors

Posted on May 29, 2011 by Dominick Baier

Another common problem with external authentication is how to deal with sign in errors. In active federation like WS-Trust there are well defined SOAP faults to communicate problem to a client. But with web applications, the error information is typically … Continue reading →

Posted in IdentityModel | Leave a comment

Access Control Service: Home Realm Discovery (HRD) Gotcha

Posted on May 24, 2011 by Dominick Baier

I really like ACS2. One feature that is very useful is home realm discovery. ACS provides a Nascar style list as well as discovery based on email addresses. You can take control of the home realm selection process yourself by … Continue reading →

Posted in Azure, IdentityModel | Leave a comment