|
|
Building a Claims-Based Security Model in WCF - Part 1
|
Last Update 2007/7/18 14:15
|
Category
Programming
.NET
:
Programming
Security
|
Description
WCF introduces a claims-based approach to security at service boundaries, improving on role-based and permission-based security models. Claims can represent many different types of information including identity, roles, permissions or rights and even general information about the caller that may be useful to the application. A set of claims is also vouched for by an issuer such as a security token service, adding credibility to the information described by each claim – something not present in role-based or permission-based models. An additional benefit of using a claims-based security model is that it supports federated and single sign-on scenarios. This two-part article will explain how claims-based security is supported by WCF, and show you how to implement a claims-based security model for your services. In this first article I’ll start by providing a quick review of the traditional role-based model most .NET applications rely on, and then I’ll compare this model to the claims-based model supported by WCF. In the process, I’ll explain how different security tokens are converted into claims, how the security context for each request is initialized with those claims, and how you can interact with claims to authorize calls. I’ll also explain how to define custom claims for an application, how to normalize different credentials into that set of claims using a custom authorization policy, and how to handle authorization centrally or at each service operation. In the second article I’ll show you how to refine this claims-based authorization model working with custom security principals and claims-based permission demands. I’ll then explain how you can decouple authentication using security token services or CardSpace, and how to work with SAML tokens that carry normalized claims.
|
|
Hits: 246
|
|
Software Development Expertise
|
Software Development Jobs
|