This document discusses using federated identity management with Azure AppFabric Access Control Service (ACS) and Windows Identity Foundation (WIF) for single sign-on in software as a service applications. The solution allows leveraging popular identity providers like Google and Yahoo for authentication while avoiding the need to manage user accounts. ACS acts as an aggregator between identity providers and relying parties. WIF is used to integrate applications with ACS and manage claims. The approach favors proven security standards over custom code and avoids storing sensitive user data.

1. SaaS Security Using
Federated Identity Management
Azure AppFabric Access Control Service (ACS)
Windows Identity Foundation (WIF)

2. What Were The Requirements?
• Favor proven security frameworks and industry standards over custom
security code
• Single sign on (SSO) between tenants
• Preferably not own or manage sensitive data
• Avoid account management in the app such as lost password, etc.

3. Our Solution: Federated Identity Management
• Leverage popular web identity providers such as Google, Yahoo.
• Leverage Azure ACS as an aggregator of these providers
• Leverage WIF for integration with ACS and claims management

4. Concept Diagram
Federation Provider
Identity Providers OpenID ACS SAML Relying Party (RP)
IIS
Google
* WIF
Claim
Yahoo STS

5. Demo
Setup Azure AppFabric Access Control Service (ACS)

6. Demo – Preview Portal

7. Demo – Portal

8. Demo – Create Namespace

9. Demo – Manage Access Control

10. Demo – Identity Provider

11. Demo – Relying Party Application Settings

12. Demo – RP – Authentication Settings

13. Demo – Edit Rule Group

14. Demo – Generate Rules To Create Claims

15. Demo – WS-Federation Metadata

16. Demo
Setup Windows Identity Foundation (WIF)

17. Demo – Add STS Reference

18. Demo – Application URI

19. Demo – STS Location

20. Demo – Add Project Reference

21. ASP.NET Request Validation
Error Message:
System.Web.HttpRequestValidationException: A potentially
dangerous Request.Form value was detected from the client
(wresult="<t:RequestSecurityTo...").
Workaround For Testing:
Solution For Production:

22. Authentication Flow Diagram
1 3
Browser
6 4
2 5
MVC Website Access Control Identity Providers(IP)
Service (ACS)
Google Yahoo
WIF STS
1. Request login returns 302 redirect to ACS 4. Post credentials, returns token with 302
2. Request IP selection form from ACS redirect to ACS
3. Request login form from IP 5. Validate and transform token to SAML
claims.
6. Post SAML to MVC website callback. WIF
processes and sets cookie.

23. Demo
Claims Authentication And Authorization

24. Demo - Claims

25. Disadvantages
• Your user identities are tied to your ACS namespace - challenging if you
ever wanted to migrate away from your ACS namespace
• Additional cost – you pay for each token issued
• Reliance on external service for authentication
• WIF is not well integrated into the .NET framework (but that improves in
4.5) – WIF is also not very DI friendly

26. Summary
• Low barrier to entry for using existing social identities in your app
• ACS and WIF encapsulate the complexity
• Users don’t need to remember another username and password
• Developers get to save time implementing and maintaining account
management features