ADFS 2.0 windows authentication with custom roles

Question

we are looking into changing our standard windows authentication process to use Claim based authentication. To do this, we are looking to install and set up ADFS 2.0 to work with AD. A separate database stores the roles which will need to be added to the claim.

Although we can find samples on WIF and how to use it within the application, we're currently struggling to

1. find work throughs for setting up ADFS 2.0 with AD
2. At what point in the process are the roles added from the separate database

any pointers would be greatly appreciated.

as a note the technology that we are using is MVC4.0 the seperate database that stores the roles is a MYSQL database

Answer 1

Custom roles can be injected locally using the local claims authentication manager. The manager fires locally and lets you augment the federated identity.

You can have the manager firing only once when the session authentication module creates a local cookie or have it firing upon every request. Consult my blog entries for more details:

http://www.wiktorzychla.com/2011/07/wif-and-custom-userdata-in.html

http://www.wiktorzychla.com/2012/09/sessionauthenticationmodule-and-dynamic.html