WCF service consuming passively issued SAML token

Question

What is the best way to pass an existing SAML token from a website already authenticated via a passive STS?

We have built an Identity Provider which is issuing passive claims to the website for authentication. We have this working. Now we would like to add some WCF services into the mix - calling them from the context of the already authenticated web application. Ideally we would just like to pass the SAML token on without doing anything to it (i.e. adding new claims / re-signing). All of the examples I have seen require the ActAs sts implementation - but is this really necessary? This seems a bit bloated for what we want to achieve.

I would have thought a simple implementation passing the bootstrap token into the channel - using the CreateChannelActingAs or CreateChannelWithIssuedToken mechanism (and setting ChannelFactory.Credentials.SupportInteractive = false) to call the WCF service with the correct binding (what would that be?) would have been enough.

We are using the Fabrikam example code as reference, but as I say, think the ActAs functionality here is overkill for what we are trying to achieve.

Flesrouy Flesrouy · Accepted Answer · 2010-07-08T13:08:17

What you need in this case is to insert the contents of your token into each outgoing message. If you look at the WIF Identity Training Toolkit they have an IssuedTokenHeader class that will facilitate this (along with the ClaimsIdentitySessionManager). These classes were built for Silverlight but, it doesn't change the solution they offer.

Here is an excerpt from the ClaimsIdentitySessionManager class.

using (OperationContextScope scope = new OperationContextScope(contextChannel))
{
   IssuedTokenHeader header = new IssuedTokenHeader(this.TokenCache.GetTokenFromCache(serviceAppliesTo));
   OperationContext.Current.OutgoingMessageHeaders.Add(header);
   asyncOperation();
}

WCF service consuming passively issued SAML token

1 Answers