Category Archives: IdentityModel

Getting JSON web tokens (JWTs) from ADFS via Thinktecture IdentityServer’s ADFS Integration

Posted on April 15, 2013 by Dominick Baier

Originally posted on brockallen:
Dominick and I recently added three features to IdentityServer that collectively we call “ADFS Integration”. This “ADFS Integration” is a new protocol (which can be enabled, disabled and configured like any other protocol IdentityServer supports). In…

Posted in IdentityModel, IdentityServer, OAuth, Uncategorized, WebAPI | Leave a comment

Driving the WS-Federation Handshake from ASP.NET Web API

Posted on April 14, 2013 by Dominick Baier

In general I think the API design of the WS-Federation support in WIF / .NET 4.5 is a bit unfortunate. It was a strange decision to combine the HTTP module (aka the FAM) and the more generic protocol helpers into … Continue reading →

Posted in ASP.NET, IdentityModel, WebAPI | 7 Comments

Going to NDC? Get two extra Days of Identity and Access Control!

Posted on April 10, 2013 by Dominick Baier

Claims, WS-Federation, WS-Trust, WS-Security, ASP.NET, Federation, Single Sign-On, Home Realm Discovery, WCF, SAML, JWT, Web API, OAuth2, Thinktecture IdentityServer & IdentityModel, ADFS, Windows Azure Active Directory & Access Control… Do the above terms sound interesting? Then join me for a … Continue reading →

Posted in Azure, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | 2 Comments

Pro ASP.NET Web API Security

Posted on April 4, 2013 by Dominick Baier

Check out Badri’s book. Essential information about securing ASP.NET Web APIs! http://amzn.com/1430257822

Posted in IdentityModel, OAuth, WebAPI | 2 Comments

Common OAuth2 Vulnerabilities and Mitigation Techniques

Posted on March 15, 2013 by Dominick Baier

In the last post I described some of the general problems with OAuth2 and its implementations. In this post I want to go into more detail and show some necessary hardening steps. We did our best (well as much as … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, WebAPI | 4 Comments

OAuth2 Security

Posted on March 15, 2013 by Dominick Baier

Right now there are many good “discussions” on OAuth2 security happening. Some are constructive, some rather destructive – and some simply hack one or the other website to prove the point. In my opinion there are a number of reason … Continue reading →

Posted in IdentityModel, IdentityServer, OAuth, WebAPI | 11 Comments

Introducing OAuth2 Code Flow and Refresh Token Support in Thinktecture IdentityServer

Posted on March 15, 2013 by Dominick Baier

We recently merged OAuth2 code flow and refresh token support into the main branch on Github. Please give it a try and tell us if it is working for you or not. After that feedback phase I will release v2.2 … Continue reading →

Posted in ASP.NET, IdentityModel, IdentityServer, OAuth, WebAPI | 17 Comments

Alternative to Thread.CurrentPrincipal in ASP.NET Web API

Posted on March 11, 2013 by Dominick Baier

Those who know me also know that I was always an advocate of Thread.CurrentPrincipal (or ClaimsPrincipal.Current in .NET 4.5). But I also understand that some people (or frameworks) don’t like ambients and rather deal with instance variables. To cater for … Continue reading →

Posted in ASP.NET, IdentityModel, WebAPI | Leave a comment

Claims-based Identity & Access Control Pre-Conference Workshop at NDC 2013

Posted on February 13, 2013 by Dominick Baier

This is great news! If you are going to NDC, you can take my identity & access control training as a pre-conference workshop. I have divided the content in a “web apps” day and a “services & the cloud” day. This … Continue reading →

Posted in .NET Security, ASP.NET, Azure, Conferences & Training, IdentityModel, IdentityServer, OAuth, WCF, WebAPI | Leave a comment

ASP.NET Web API Authentication using the Microsoft Account

Posted on February 2, 2013 by Dominick Baier

The last days I’ve been researching some of the new security features in Windows 8. One of the biggest changes in Windows is definitely the fact that you can now login using your Microsoft Account. I will describe the details … Continue reading →

Posted in ASP.NET, IdentityModel, OAuth, WebAPI | 8 Comments