Windows Identity Foundation(WIF)

Introduction

First of all, I'll say Windows Identity Foundation is a Microsoft way to leverage the Claim based Authentication. Let's see the definition from MSDN.
Windows Identity Foundation enables .NET developers to externalize identity logic from their application, improving developer productivity, enhancing application security, and enabling interoperability. Enjoy greater productivity, applying the same tools and programming model to build on-premises software as well as cloud services. Create more secure applications by reducing custom implementations and using a single simplified identity model based on claims. Enjoy greater flexibility in application deployment through interoperability based on industry standard protocols, allowing applications and identity infrastructure services to communicate via claims.
So we can say, Windows Identity foundation provides a set of classes which facilitates in implementing Claim based authentication.

Prerequisites

To use WIF, you need Windows 2003 server+ or Windows 7/8/Vista.

• WIF for Win server 2003 - download it from here
• WIF for Win 7+ - download it from here
• WIF SDK - download it from here

WIF SDK provides some Visual Studio templates that help in developing Claim aware applications. These templates are:

• ASP.NET Security Token Service Web Site
• Claims-aware ASP.NET Web Site
• Claims-aware WCF Service
• WCF Security Token Service

The above templates are available in New Website under File Menu.

Let's Discuss an Example

So today, we will create an ASP.NET application (Relying Party Application-RP). And also, we'll create a custom Identity provider and we'll use this identity provider for authentication of the user.
Following are the main steps we need to perform:

• Create a Custom Identity Provider
• Create an ASP.NET application
• Create a trust between Identity provider and ASP.NET application

So let's first create an Identity Provider.

Creating a Custom Identity Provider

So here, I will create a step by step process to create a Custom Identity Provider.
Open Visual Studio-> Create new website -> select ASP.NET Security Token Service Web Site (I have selected the location HTTP to host it at IIS directly.)

Now your sample Identity provider is created. It provides the basic infrastructure for you. It includes one login page that actually authenticates the user and here forms authentication is used.

Create an ASP.NET application

I have created an ASP.NET application as below:

Now as this already created an inbuilt authentication module. You can remove it all because we'll not be using this. Or you can create an empty ASP.NET solution and some page as per your requirement. I have removed the account folder for the demo.
Create a trust between Identity provider and ASP.NET application(RP)
This can be done using FedUtil provided by WIF SDK. Also from UI, we can add an STS reference in the ASP.NET website and make a trust relationship between Identity Provider and Relying Party. Look the following steps to add the reference.

• Add an STS Reference to ASP.NET website.

• This is the first screen of FedUtil which displays the URI and location of ASP.NET website(RP):

• If you have not hosted your ASP.NET website(RP) on SSL, it will show the following Warning. At Production, all the communication between Identity Provider and ASP.NET website(RP) should happen over SSL only. Here for demo purposes, I didn't use SSL. I clicked on Yes.

• In this screen, it asks to select the STS (Security Token Service). And has three options. As we have created the STS, we need to select the option "Use an existing STS".

To build the trust relationship, we need to provide the federation metadata provided Identity Provider.

• Now we need to browse the FederationMetada XML file of the STS that we created.

FederationMetadata file resides in a special folder hierarchy “FederationMetadata/2007-06? under the STSWebsite physical folder.

• And Select the FederationMetdata. And Click next.

• Again as my STS is not hosted at SSL, it is showing the below warning message. I just clicked Yes.

• Here it asks if one wants to encrypt the token. It should be encrypted on production. Here I have selected the option "No Encryption" for the demo.

• Now it shows all the claims passed by STS to RP. We can pass more claims from STS to RP as per our requirement. All the Claims is shown here while adding the STS reference.By default, there are only two roles provided by STS (Name & Role).

• This is the Summary screen, shows the details about STS and RP. One needs to review and click finish.

Note: Here there is an option to update the federation metadata on a routine basis. One needs to know if the STS is getting changes, say Token or Claims, etc. RP would only come to know about when federationmetadata will be updated, else say if someone removed a Claim and metadata is not updated, it will allow to get the that Claim but actually at runtime you would not get that claim which will not be a good condition. One should always have the metadata in updated form.
After clicking Finish. A folder FederationMetadata is added to ASP.NET website (Relying Party -RP) as below:

Let's run the application.
Now if you run the application, it will throw an exception as “Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack.”
This is an issue with it and I have made a small post on it. You can get it resolved easily. Please check this [^] .
Now after changes, it will run smoothly and it will take you to the login page that is provided by STS. This is the default login page provided STS, here you don't need to write password, just put some name and click on login as below:

It will redirect to another page to STS which will actually initiate the process to create the token and claims. Then after creating, it will be transferred to your website as authenticated user.
Now our application is running. As here in STS, we have a sample login page the uses Forms authentication and by default authenticates every user. Here we can put our code, whether we want to authenticate the user using windows authentication/Form authentication and use database all we can and also we can get some data of the user from any store say DB here and that we can send using in Claims as per our requirement.
So now here I’ll show how to pass some more information to the user in Claims. So one can get additional claims here. When you create an STS, there are four files get added in App_Code folder. One file named CustomSecurityTokenService.cs. In this file, there is a method GetOutputClaimsIdentity that actually creates the claims. We need to add the claims here (I have added few):

/// <summary>
/// This method returns the claims to be issued in the token.
/// </summary>
/// <param name="principal">The caller's principal.
/// <param name="request">The incoming RST, can be used to obtain additional information.
/// <param name="scope">The scope information corresponding to this request.
/// <exception cref="ArgumentNullException">If 'principal' parameter is null.</exception>
/// <returns>The outgoing claimsIdentity to be included in the issued token.</returns>
protected override IClaimsIdentity GetOutputClaimsIdentity
    ( IClaimsPrincipal principal, RequestSecurityToken request, Scope scope )
{
    if ( null == principal )
    {
        throw new ArgumentNullException( "principal" );
    }
    IClaimsIdentity claimsIdentity = (IClaimsIdentity)principal.Identities[0];
    ClaimsIdentity outputIdentity = new ClaimsIdentity();
    // Issue custom claims.
    // Update the application's configuration file too to reflect new claims requirement.
    outputIdentity.Claims.Add( new Claim
    ( System.IdentityModel.Claims.ClaimTypes.Name, principal.Identity.Name ) );
    outputIdentity.Claims.Add(new Claim(ClaimTypes.Role, "Manager"));
    //I added these custom claims
    outputIdentity.Claims.Add(new Claim(ClaimTypes.Email, "brij@gmail.com"));
    outputIdentity.Claims.Add(new Claim(ClaimTypes.Gender, "Male"));
    return outputIdentity;
}

 

I have added two claims (Email, Gender) as above. These claims will be available at ASP.NET website (Relying Party).
The same Identity provider can be used in multiple applications.
I hope the above sample will help a lot. In my new post of this series, I will discuss another technique to implement use Claim based Authentication which is widely used called Identity Federation.

Claim Based Authentication and WIF

Introduction

There is a lot of buzz about Claim based Authentication. In this article, we'll understand what is Claim based Authentication, what are the benefits and a lot more. This is my first article in this series. In subsequent posts, we will see the implementation and more scenarios.
Let's first understand what the need is for Claim based authentication?

Problems with Current Authentication

We make several user accounts at several portals/websites. Everytime we need to access the corresponding website, we need to remember the username and password and if somehow we forget the password, then we need to remember some specific details like security question, etc. to get the access of the account again. And every time we might not remember all these details. Also, it is never advisable to write your user credentials physically.
One more problem, most of the applications use some authentication mechanism, mainly Classic UserName and Password. As most of the developers are not really security experts; they leave loopholes during development which are easy to break. So it is a major security risk.
Most of the developers have some or the other day worked on the SingleSignOn feature. It's not always been a simple task. It leads to a lot of challenges and many issues after the application is deployed on UAT/Production.
As a user, we create new user credentials (username and password) to many applications on the internet like Facebook, Yahoo, Gmail, etc. and some in-house sites like some college portal, etc. or some enterprise application. So to create new credentials every time and to remember all these credentials and see that all are secure enough is very tedious. If there is any errors, you might lose some credentials and could end up in a big loss.

Solution

Imagine the situation where you just need to have one user credential, i.e., username and password and that is enough to access all your portals/websites. This will be an ideal situation. Might be it could not take place completely, but we are somehow moving in this direction.
But how can this take place?
Actually, nowadays, when we create an application which has an authentication page, we need to understand how it works. Actually when user logs in, an Identity is assigned to that session and that Identity is maintained throughout the session until the user logs out or it expires. So let’s view the current scenario.

This means that every application which has some authentication mechanism first authenticates the user and gives an Identity and then the user gets the rights to access the application. So somehow if we can externalize the authentication part from the application, then this will be very helpful and the same authentication application is used by several applications. I explain it pictorially.

So the basic idea is, if there are some applications that do the authentication and provide the Identity (called Identity Provider), and applications rely on this identity, like in our daily life:

The above picture is self-explanatory.

Claim Based Authentication

The same mechanism is also followed in Claim based Authentication. There are some authentication/identity providers which are used by various applications whenever a user tries to access some application. The application checks whether the user is authenticated or not, if not, it forwards the user to the Identity provider which actually authenticates the user, gives a token to the user and forwards the user to the application. The application verifies the token and the user is allowed to access the application.
But this is not so easy in a web scenario. There are few challenges - Who are the Identity Providers? - What is the data needed for the relying party, i.e., what data can be transferred from Identity provider and in which form - if there are multiple Identity providers. How does the application trust them?
Actually there are a couple of Identity providers nowadays like Google, Facebook, WindowsLive Id and many more. And even we can develop our own Identity provider for on premise applications. This can be used on Cloud as well.
Now if I am making an application and my application uses some Identity provider to authenticate a user, then the application must understand the token of that Identity provider and also there must be trust relation between the application and Identity providers, so that the application can rely on the token sent by that Identity provider.

Basics of Claim based Authentication

Now let us discuss what are the basic things involved in it. These are mainly Identity, Tokens, Claims, Identity Provider or Security Token Service, RP (Relying Party), etc. To move ahead, we need to understand all of these. Let's discuss them one by one.

What is an Identity

You can say Identity is a group of information that can uniquely identify anything. Most of the other things also have identity like your own PC, Vehicle, etc. But here, we are talking about person. So in this digital era, we can say a digital identity is a group of information to identify a person.

Token and Claims

When this digital identify is passed over wire, it is passed as a stream of bytes and that is known as token. Token contains some set of information about the user in the Claim format. A token can contain multiple claims and every claim contains some specific information. The token is digitally signed so that it can be verified at the receiver end. So we can show this pictorially as:

Sometimes token can be XML based Security Assertion Markup Language (SAML) format. But now, the application uses a rather simpler token call as Simple web Token (SWT). So the benefit is that here, we do not pass user credential but we can also pass some other information of the user to the application.

Identity Provider and STS

Identity provider is the key in this technology, this actually authenticates the user and creates the token with claims, as per the requirement and digitally signs it before sending. Identity provider is also known as Security token service. So how does the STS work, let's have a view.

RP (Relying Party)

Relying party are the applications that use these Identity Providers for authentication. They just need to understand and verify the token and get all the data from the token itself which is required. But before all this, RP needs to build a trust relationship and tell the Identity provider what all data is needed for a user. So that next time it receives a token, it can verify the issuer and get the required data.

Complete Scenario

Now you guys got all the basic information about Claim based Authentication. Now let us have a look at how this Identity provider is used.

So this is the basics of Claim based Authentication.

Do share your views about this post and let me know if I have missed anything.