Resources For IT Professionals
Post an article
Wikis - Page Details
  • First published by
  • When: 13 Sep 2011 9:08 AM
  • Last revision by (eMicrosoft Partne)
  • When: 29 May 2013 3:58 AM
  • Revisions: 12
  • Comments: 4
Options
RSSSubscribe to Article (RSS)
Can You Improve This Article?
Positively! Click Sign In to add the tip, solution, correction or comment that will help other users.

Report inappropriate content using these instructions.
Wiki  >  TechNet Articles  >  Identity Flow Through Physical Tiers - ActAs Delegation

Identity Flow Through Physical Tiers - ActAs Delegation

Identity Flow Through Physical Tiers - ActAs Delegation

Back to Windows Azure Active Directory Solutions For Developers 

Table of Contents


Scenario

In this scenario you are developing distributed multi-tier application with ASP.NET web front end and WCF (SOAP) back end. You need to make sure that original user's identity who interacts with the ASP.NET web application will flow through the physical tiers to the back end WCF (SOAP) service. This requirement may come as a result of the need to perform authorization or logging and auditing at the back end WCF service based on the original caller. For example, if Bob accesses the ASP.NET front end web application then his identity should be used to log activities and perform access checks at the back end WCF service. The process of flowing the identity across physical tiers called delegation.


  • Distributed multi-tier application.
  • ASP.NET web front end.
  • WCF (SOAP) back end.
  • Original user's identity who interacts with the ASP.NET front end web application needs to flow through physical tiers to the back end WCF service.

Solution Approach

Delegation is used to solve this scenario. WIF and AD FS provide building blocks for delegation. AD FS servers as an Identity Provider (IP) that accepts credentials and issues tokens, another AD FS is configured as Claims Provider that validates the original token available the message as ActAs and adds necessary claims. The ASP.NET application uses WCF's CreateChannelActingAs to sent the token  to the WCF service which trusts Claims Provider AD FS.


  • One AD FS instance serves as Identity Provider (IP).
  • Another AD FS instance serves as Claims Provider that, configured for delegation and to trust IP instance of AD FS.
  • ASP.NET application uses bootstrap token for ActAs token.
  • ASP.NET application uses CreateChannelActionAs when communicating with WCF service.

Analysis

ASP.NET application uses bootstrap token for ActAs purposes. To do so it needs to be configured so in the WIF related section of the configuration file, specifically:
<service saveBootstrapTokens="true">
This may introduce security risk as the bootstrap tokens may contain sensitive information that can be used by an attacker if not properly protected.

How To's

Code Samples

  • Identity Delegation sample in WIF SDK

Resources
, , , , , , , , [Edit tags]
Leave a Comment
  • Please add 7 and 7 and type the answer here:
  • Post
Wiki - Revision Comment List(Revision Comment)
Wikis - Comment List
Sort by: Published Date | Most Recent | Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
Comments
  • Posted by
    on 29 May 2013 3:50 AM

    Carsten Siemens edited Revision 8. Comment: Fixed misspelling in title and added tags: en-US, has TOC

  • Posted by
    on 29 May 2013 3:54 AM

    I fixed a misspelling in the title - i.e. renamed your article.

  • Posted by
    on 29 May 2013 3:54 AM

    Carsten Siemens edited Revision 9. Comment: Added tag: has comment

  • Posted by
    on 29 May 2013 3:58 AM

    Carsten Siemens edited Revision 10. Comment: Fixed misspelling

Page 1 of 1 (4 items)