Second Edition A G UIDE TO C LAIMS -B ASED I DENTITY AND A CCESS C ONTROL Authentication and Authorization for Services and the Web Dominick Baier Vittorio Bertocci Keith Brown Scott Densmore Eugenio Pace Matias Woloski • • • • • • • • • • • • • • • • • • • • • • • • • • a guide to claims-based identity and access control a guide to Claims-Based Identity and Access Control second edition Authentication and Authorization for Services and the Web patterns & practices Microsoft Corporation This document is provided “as-is.” Information and views expressed in this document, including URLs and other Internet website references, may change without notice. You bear the risk of using it. Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. ©2011 Microsoft. All rights reserved. Microsoft, Active Directory, MSDN, SharePoint, SQL Server, Visual Studio, Windows, Windows Azure, Windows Live, Windows PowerShell, and Windows Server are trademarks of the Microsoft group of companies. All other trademarks are the property of their respective owners. Contents foreword Kim Cameron xvii foreword Stuart Kwan xix foreword Steve Peschka xxi preface Who This Book Is For xxiii Why This Book Is Pertinent Now xxiv A Note about Terminology xxiv How This Book Is Structured xxv About the Technologies xxviii What You Need to Use the Code xxix Application Server xxx ADFS xxx Active Directory xxx Client Computer xxx Who’s Who xxxi acknowledgements xxxiii 1 An Introduction to Claims 1 What Do Claims Provide? 1 Not Every System Needs Claims 2 Claims Simplify Authentication Logic 3 A Familiar Example 3 What Makes a Good Claim? 5 Understanding Issuers 5 ADFS as an Issuer 5 External Issuers 7 User Anonymity 9 Implementing Claims-Based Identity 9 Step 1: Add Logic to Your Applications to Support Claims 9 Step 2: Acquire or Build an Issuer 10 Step 3: Configure Your Application to Trust the Issuer 10 Step 4: Configure the Issuer to Know about the 11 Application A Summary of Benefits 12 Moving On 12 Questions 13 2 Claims-Based Architectures 15 A Closer Look at Claims-Based Architectures 16 Browser-Based Applications 17 Understanding the Sequence of Steps 19 Optimizing Performance 23 Smart Clients 23 SharePoint Applications and SharePoint BCS 25 Federating Identity across Realms 26 The Benefits of Cross-Realm Identity 26 How Federated Identity Works 28 Federated Identity with ACS 29 Understanding the Sequence of Steps 31 Combining ACS and ADFS 32 Identity Transformation 32 Home Realm Discovery 32 Design Considerations for Claims-Based Applications 35 What Makes a Good Claim? 35 How Can You Uniquely Distinguish One User from Another? 36 How Can You Get a List of All Possible Users and All Possible Claims? 36 Where Should Claims Be Issued? 37 What Technologies Do Claims and Tokens Use? 38 Questions 41 3 Claims-based Single Sign-on for the Web and Windows Azure 43 The Premise 43 Goals and Requirements 45 Overview of the Solution 46 Inside the Implementation 49 a-Expense before Claims 49 a-Expense with Claims 52 a-Order before Claims 59 a-Order with Claims 59 Signing out of an Application 60 Setup and Physical Deployment 61 Using a Mock Issuer 61 Isolating Active Directory 62 Handling Single Sign-out in the Mock Issuer 63 Converting to a Production Issuer 63 Enabling Internet Access 64 Variation—Moving to Windows Azure 64 Questions 68 More Information 69 4 Federated Identity for Web Applications 71 The Premise 71 Goals and Requirements 72 Overview of the Solution 72 Benefits and Limitations 77 Inside the Implementation 77 Setup and Physical Deployment 77 Using Mock Issuers for Development and Testing 78 Establishing Trust Relationships 78 Questions 79 More Information 80 5 Federated Identity with Windows Azure Access Control Service 81 The Premise 82 Goals and Requirements 82 Overview of the Solution 83 Example of a Customer with its Own Identity Provider 84 Example of a Customer Using a Social Identity 86 Trust Relationships with Social Identity Providers 88 Description of Mapping Rules in a Federation Provider 89 Alternative Solutions 91 Inside the Implementation 93 Setup and Physical Deployment 94 Establishing a Trust Relationship with ACS 94 Reporting Errors from ACS 95 Initializing ACS 95 Working with Social Identity Providers 96 Managing Users with Social Identities 96 Working with Windows Live IDs 97 Working with Facebook 98 Questions 99 More Information 100 6 Federated Identity with Multiple Partners 101 The Premise 101 Goals and Requirements 102 Overview of the Solution 103 Step 1: Present Credentials to the Identity Provider 104 Step 2: Transmit the Identity Provider’s Security Token to the Federation Provider 104 Step 3: Map the Claims 105 Step 4: Transmit the Mapped Claims and Perform the Requested Action 105 Using Claims in Fabrikam Shipping 107 Inside the Implementation 109 Setup and Physical Deployment 117 Establishing the Trust Relationship 117 Organization Section 118 Issuer Section 118 Certificate Section 118 User-Configurable Claims Transformation Rules 119 Questions 119 7 Federated Identity with Multiple Partners and Windows Azure Access Control Service 123 The Premise 124 Goals and Requirements 125 Overview of the Solution 127 Step 1: Present Credentials to the Identity Provider 128 Step 2: Transmit the Identity Provider’s Security Token to the Federation Provider 129 Step 3: Map the Claims 129 Step 4: Transmit the Mapped Claims and Perform the Requested Action 130 Step 1: Present Credentials to the Identity Provider 131 Step 2: Transmit the Social Identity Provider’s Security Token to ACS 131 Step 3: Map the Claims 132 Step 4: Transmit the Mapped Claims 132 and Perform the Requested Action Enrolling a New Partner Organization 132 Managing Multiple Partners with a Single Identity 133 Managing Users at a Partner Organization 134 Inside the Implementation 135 Getting a List of Identity Providers from ACS 135 Adding a New Identity Provider to ACS 137 Managing Claims-Mapping Rules in ACS 137 Displaying a List of Partner Organizations 138 Authenticating a User of Fabrikam Shipping 139 Authorizing Access to Fabrikam Shipping Data 140 Setup and Physical Deployment 141 Fabrikam Shipping Websites 141 Sample Claims Issuers 142 Initializing ACS 142 Questions 143 More Information 144 8 Claims Enabling Web Services 145 The Premise 145 Goals and Requirements 146 Overview of the Solution 146 Inside the Implementation 148 Implementing the Web Service 148 Implementing the Active Client 150 Implementing the Authorization Strategy 153 Debugging the Application 154 Setup and Physical Deployment 155 Configuring ADFS 2.0 for Web Services 155 Questions 156 9 Securing REST Services 159 The Premise 159 Goals and Requirements 160 Overview of the Solution 160 Inside the Implementation 162 The ACS Configuration 162 Implementing the Web Service 163 Implementing the Active Client 167 Setup and Physical Deployment 172 Configuring ADFS 2.0 for Web Services 172 Configuring ACS 172 Questions 173 More Information 174 10 Accessing Rest Services from a Windows Phone Device 175 The Premise 176 Goals and Requirements 176 Overview of the Solution 177 Passive Federation 177 Active Federation 179 Comparing the Solutions 181 Inside the Implementation 183 Active SAML token handling 183 Web browser control 185 Asynchronous Behavior 187 Setup and Physical Deployment 191 Questions 191 More Information 193 11 Claims-Based Single Sign-On for Microsoft SharePoint 2010 195 The Premise 196 Goals and Requirements 196 Overview of the Solution 197 Authentication Mechanism 197 End-to-End Walkthroughs 199 Visiting Two Site Collections in a SharePoint Web Application 199 Visiting Two SharePoint Web Applications 200 Authorization in SharePoint 201 The People Picker 202 Single Sign-Out 204 Inside the Implementation 205 Relying Party Configuration in ADFS 205 SharePoint STS Configuration 206 Create a New SharePoint Trusted Root Authority 206 Create the Claims Mappings in SharePoint 207 Create a New SharePoint Trusted Identity Token Issuer 207 SharePoint Web Application Configuration 209 People Picker Customizations 210 Single Sign-Out Control 212 Displaying Claims in a Web Part 214 User Profile Synchronization 214 Setup and Physical Deployment 215 FedAuth Tokens 215 ADFS Default Authentication Method 216 Server Deployment 216 Questions 217 More Information 218 12 federated identity for sharepoint applications 219 The Premise 219 Goals and Requirements 220 Overview of the Solution 220 Inside the Implementation 224 Token Expiration and Sliding Sessions 224 SAML Token Expiration in SharePoint 225 Sliding Sessions in SharePoint 228 Closing the Browser 232 Authorization Rules 232 Home Realm Discovery 232 Questions 234 More Information 236 appendices a using fedutil 237 Using FedUtil to Make an Application Claims-Aware 237 b message sequences 239 The Browser-Based Scenario 240 The Active Client Scenario 252 The Browser-Based Scenario with Access Control Service (ACS) 258 Single Sign-Out 273 c industry standards 285 Security Assertion Markup Language (SAML) 285 Security Association Management Protocol (SAMP) and Internet Security Association and Key Management Protocol (ISAKMP) 285 WS-Federation 285 WS-Federation: Passive Requestor Profile 286 WS-Security 286 WS-SecureConversation 286 WS-Trust 286 XML Encryption 286 d certificates 287 Certificates for Browser-Based Applications 287 On the Issuer (Browser Scenario) 287 Certificate for TLS/SSL (Issuer, Browser Scenario) 287 Certificate for Token Signing (Issuer,