identity- 1

Views:
 
Category: Entertainment
     
 

Presentation Description

No description available.

Comments

Presentation Transcript

Get a WIF of this! : 

Get a WIF of this! An introduction to Identity with WIF & AD FS 2.0

About Todd Anderson : 

About Todd Anderson Email me: [email protected]

About Zoiner Tejada : 

About Zoiner Tejada Email me: [email protected]

Windows Identity Foundation : 

Windows Identity Foundation This presentation will focus on how WIF: Can be used with websites as well as web services. Makes life much easier for the developer. Opens up possibilities that normally have been prohibitively complex. Now to introduce the participants of this presentation:

The Ultimate Surfboard...The WIFboard : 

The Ultimate Surfboard...The WIFboard WIF (Windows Identity Foundation)– It’s not just about Federation, it’s about outsourcing security decisions Designed to integrate with ASP.NET and WCF applications.

The Surf SpotRelying Party (RP) : 

The Surf SpotRelying Party (RP) Replying parties are your applications: Web Sites WIF is used with a passive client, the browser. Web Services WIF is used in an Active manner.

The KahunaSTS / Identity Provider : 

The KahunaSTS / Identity Provider Kahuna is the Hawaiian term for Authority The same goes for a Security Token Service. A Security Token Service is an authority on providing identity for the relying party. An STS is generally a web service. The Surf Spot expects to know how to talk with the Kahuna. Various standards at play to achieve this.

The ShakaSecurity Tokens : 

The ShakaSecurity Tokens Security Tokens contain claims. These claims are information the RP needs to know about the user. For permission to surf at the spot, the surfer must go to that spot’s Kahuna and ask for a shaka, then present this shaka to the surf spot.

The Surfer (user) : 

The Surfer (user) In order to have authorization to surf at a surf spot (RP), the surfer must get shakas from the Kahuna (STS) and present them. Some surf spots require a closer look at the shakas (security token claims) from the Kahuna. This surfer’s claim indicates he’s ridden ten foot barrels! He can surf here.

The Surf Mobile FedUtil.exe : 

The Surf Mobile FedUtil.exe FedUtil.exe is a configuration wizard that’s run against your application (RP) It tells the surf spot to trust the Kahuna To use FedUtil.exe in Visual Studio Right-click your website or web service select "Add STS Reference...“ Provide information about The location of your RP What STS to use Certificate settings

Demo : 

Demo Create a claims enabled web site that utilizes a simple STS Create a claims enabled web service that utilizes a simple STS

All you need to go surf : 

All you need to go surf A standards compliant Kahuna (STS) A surf spot (RP) The Surf Mobile (FedUtil.exe) A trusty WIFboard

Passive Federation : 

Passive Federation WSFAM - WSFederationAuthenticationModule Enables passive authentication SAM - SessionAuthenticationModule Handles sessions. CAM - ClaimsAuthorizationModule (CAM) You configure your claims-based authorization here.

DEMO : 

DEMO Converting a membership/role provider based website to a claims based one

Federating identity : 

Federating identity How would a surf spot trust the authority of Kahunas from other islands? When your RP wants to authorize users from multiple IP-STSs, you use an FP-STS as an intermediary between the IP-STSs and your RP.

Federation Provider : 

Federation Provider A Federation Provider is also an STS, but it passes thru or transforms claims The FP-STS accepts the tokens from the IP-STSs and if necessary, can transform the claims in these tokens before providing them to the RP.

Where is my KahunaHome Realm Discovery (HRD) : 

When there is more than one Kahuna for a user to authenticate at.. Upon arriving at the RP, you need to be redirected to the correct IP-STS for authentication. Two approaches Indicate which Kahuna via URL Have user pick from list Where is my KahunaHome Realm Discovery (HRD)

Delegation : 

Delegation Without WIF, it is similar to needing a different surfboard for each condition you may encounter. Trusted Subsystem is a security risk When Johnny Utah logs into the web application, he is actually using Brodiliah’s admin account to be able to access the backend data. With some clever tricks, Johnny could be able to gain access to information he’s not supposed to be able to reach. The solution? Keep passing the original users credentials with delegation, tacking on other claims as needed downstream.

Federating Non-Claims Aware Apps : 

Federating Non-Claims Aware Apps Claims to Windows Token Service (C2WTS) C2WTS enables use of legacy or 3rd party systems that rely on Windows Integrated Authorization and cannot be migrated to using claims. Claims presented are converted to an impersonated Windows identity on the local box and the target application works as before. e.g., SQL Server

A Real-Life Big Kahuna : 

A Real-Life Big Kahuna let’s look at AD FS 2.0...

What is AD FS 2.0? : 

AD FS 2.0 Major Components Attribute Stores What is AD FS 2.0? Active Directory LDAP MS SQL Federation Server Federation Server Proxy Claims Engine Management Snap-in WIF Windows Server 2003, 2008 SP2, 2008 R2Windows 7, Vista SP2 .NET 3.5 SP1 IIS 6/7 Windows Internal DB Website Web Service Other Claims Providers CA IBM SUN WIF Other STS Relying Parties Browser Apps Smart Clients Web Services AD FS 2.0 provides access and single sign-on for on-premises and cloud-based applications in the enterprise, across organizations, and on the Web

ADFS 2.0 Benefits : 

ADFS 2.0 Benefits Benefits of SSO reduce administrative overhead reduce security vulnerabilities as a result of lost or stolen passwords improve user productivity Intra-Enterprise: provide SSO for all your web sites and applications Pan-Enterprise: provide SSO experiences for your users to access apps in other organizations provide SSO experience for users from external organizations to access your apps Easily externalize authentication & authorization Rich claims rules processing engine Management & Configuration Tools

Why even consider AD FS 2.0? : 

Why even consider AD FS 2.0? Building a production-ready STS is hard. The Visual Studio STS templates are just starters for trivial dev scenarios. Lot's of config to manage, UI's to present in real world STS!

Moving to ADFS : 

Moving to ADFS

DEMO : 

DEMO Migrating from a development STS to AD FS 2.0

Other Scenarios : 

Other Scenarios

Useful Links : 

Useful Links Blog: http://TheWorkflowElement.com WIF Dev Center - http://msdn.microsoft.com/en-us/security/aa570351.aspx For WIF SDK LABS link to Online STS (AD FS 2) https://ip-sts-01.federatedidentity.net/federationmetadata/2007-06/federationmetadata.xml There's a few links floating around that are wrong...this is the correct one. C2WTS - http://msdn.microsoft.com/en-us/library/ee517278.aspx ADFS How to Guides - http://technet.microsoft.com/en-us/library/dd727938(WS.10).aspx (  ) Self-STS - http://code.msdn.microsoft.com/SelfSTS