Help with WIF proof-of-concept

0
votes

I have been charged with the task of implementing a proof-of-concept for Windows Identity Foundation in my organization. The reason for the POC is that we do not have ADFS implemented but want to develop a unified authentication and authorization strategy for applications as we move forward.

The solution I will be working with consists of an ASP.NET MVC 2 application that consumes a RESTful WCF service application with a back-end SQL Server database. The solution currently uses Windows Authentication with custom permissions assigned based on the authenticated user's group membership. We want to maintain the single sign-on capabilities in the new solution.

Here's what I need help with:

  1. Setting up a temporary IP STS to use in lieu of ADFS
  2. Setting up a relaying STS that adds application-specific claims to the token
  3. How to set-up the solution the allow single sign-on, meaning that I don't prompt for the user's credentials but use their (Windows) identity when accessing the MVC site.
  4. I also want to make sure that the web services are secure in the event another consumer tries to access them.

Any help putting this together would be greatly appreciated. Most of what I'm reading assumes ADFS is in place and uses Forms Authentication so I'm at a loss how to satisfy my requirements.

2
wif

2 Answers

1
votes

Have a look at IdentityServer. This is a MVC based (with a sample MVC client) which allows authentication against a SQL Server roles based DB. This serves as your STS and you can add code to add specific claims. The only thing it won't address is point 3 as it uses DB authentication.

It has recently been upgraded to support Azure integration. That then allows you to authenticate using Facebook, Google etc. May not be of interest but certainly makes for a whizzy demo.!

BTW, have a look at SelfSTS. This is a STS which allows you to easily configure any type of claim you want (albeit with no authentication). Very useful for a simple claims PoC.

0
votes

WIF SDK has many examples of this, active and passive.