Claims-Based Identity

Solution Architect Briefingzoli.herczeg.ro

Taken from David Chappel’s work at TechEd Berlin 2009

Agenda

• Introducing Claims-Based Identity

• Using Claims-Based Identity: Scenarios

• Microsoft Technologies for Claims-Based Identity: A Closer Look

Introducing Claims-Based Identity

Claims-Based Identity The core Microsoft technologies

Active Directory Federation Services (AD FS) 2.0The next release of AD FS

CardSpace 2.0The next release of CardSpace

Windows Identity Foundation (WIF) 1.0Pronounced “Dub-I-F”

These three technologies were previously code-named “Geneva”

What is Identity?An identity is a set of information about some entity, such as a user

Most applications work with identityIdentity information drives important aspects of an application’s behavior, such as:

Determining what a user is allowed to doControlling how the application interacts with the user

Defining the ProblemWorking with identity is too hard

Applications must use different identity technologies in different situations:

Active Directory (Kerberos) inside a Windows domainUsername/password on the InternetWS-Federation and the Security Assertion Markup Language (SAML) between organizations

Why not define one approach that applications can use in all of these cases?

Claims-based identity allows thisIt can make life simpler for developers

Token

Signature

Example Claims

Name

Group

Age

Claim 1Claim 2

. . .Claim n

Claim 3

Tokens and Claims Representing identity on the wire

A token is a set of bytes that expresses information about an identity

This information consists of one or more claimsEach claim contains some information about the entity to which this token applies

Indicates who created this token

and guards against changes

Identity Providers and STSsAn identity provider (or issuer) is an authority that makes claims about an entity

Common identity providers today:On your company’s network: Your employerOn the Internet: Most often, you

An identity provider implements a security token service (STS)

It’s software that issues tokensRequests for tokens are made via WS-Trust

Many token formats can be usedThe SAML format is popular

Identity Provider

Account/ Attribute Store

Security Token Service (STS)

2) Get information

1) Authenticate user and request

token

3) Create and return token

Token

Browser or Client

User

Getting a TokenIllustrating an identity provider and an STS

4) Use claims in token

Browser or Client

User

Identity Provider

Acquiring and Using a Token

1) Authenticate user and get token

Token2) Submit

token

Token

List of Trusted STSs

Application 3) Verify token’s signature and check whether

this STS is trustedIdentity Library

STS

Why Claims Are an ImprovementIn today’s world, an application typically gets only simple identity information

Such as a user’s name

To get more, the application must query:A remote database, e.g., a directory serviceA local database

With claims-based identity, each application can ask for exactly the claims that it needs

The STS puts these in the token it creates

How Applications Can Use ClaimsSome examples

A claim can identify a userA claim can convey group or role membershipA claim can convey personalization information

Such as the user’s display nameA claim can grant or deny the right to do something

Such as access particular information or invoke specific methods

A claim can constrain the right to do something Such as indicating the user’s purchasing limit

5) Use claims in token

User

ApplicationIdentity Providers

STSSTS

Identity Selector

1) Access application and

learn token requirements

2) Select an identity that matches those

requirements

3) Authenticate user and get token

for selected identity

Token 4) Submit token

Token

Supporting Multiple IdentitiesUsing an identity selector

Identity Library

Browser or Client

STS

5) Use claims in token

User

Application

STSSTS

CardSpace 2.0

1) Access application and

learn token requirements

2) Select an identity that matches those

requirements

3) Authenticate user and get token

for selected identity

Token 4) Submit token

Token

Claims-Based Identity for Windows

Windows Identity Foundation

Browser or Client

STS

AD FS 2.0

Identity Providers

Using Claims-Based Identity: Scenarios

AD FS 2.0

User

2) Access application and

learn token requirements

Active Directory Domain Services

5) Find claims required by application and create

token

3) Select an identity that matches those

requirements

STS

8) Use claims in token

Application

WIF

CardSpace 2.0

6) Receive token

Token

7) Submit token

Token

An Enterprise Scenario

1) Login to domain and get Kerberos

ticket

4) Present Kerberos ticket

and request token for

selected identity

Browser or Client

Internet

User

2) Select an identity that matches those

requirements

AD FS 2.0Active Directory Domain Services

1) Access application and

learn token requirements

5) Use claims in token

Application

WIF

CardSpace 2.0

3) Authenticate user and get token

for selected identity

TokenToken

4) Submit token

Allowing Internet Access

STS

Browser or Client

5) Use claims in token

Identity Providers

STS

Internet

Windows Live ID

Other

User

2) Select an identity that matches those

requirements

1) Access application and

learn token requirements

CardSpace 2.0

Application

WIF4) Submit

token

Token

3) Authenticate user and get token for selected identity

Token

Using an External Identity Provider

STS

Browser or Client

Identity Across OrganizationsDescribing the problem

• A user in one Windows forest must access an application in another Windows forest

• A user in a non-Windows world must access an application in a Windows forest (or vice-versa)

Identity Across OrganizationsPossible solutions

• One option: duplicate accounts– Requires separate login, extra administration

• A better approach: identity federation – One organizations accepts identities provided by the

other• No duplicate accounts• Single sign-on for users

2) Select an identity that

matches those requirements

AD FS 2.0

Organization X

User

Active Directory Domain Services

Organization Y

STS

Trusted STSs:-Organization Y-Organization X

1) Access application and learn token

requirements

CardSpace 2.0

5) Use claims in token

Application

WIF

3) Get token for selected identity

Token

4) Submit token Token

Identity Federation (1)

STS

Browser or Client

3) Select an identity that

matches those requirements

AD FS 2.0

User

Active Directory Domain Services

1) Access application and learn token

requirements

2) Access Organization Y STS and learn

token requirements

Trusted STSs:-Organization X

Trusted STSs:-Organization Y

STS

CardSpace 2.0

8) Use claims in token

Application

WIF

6) Issue token for application

Token

7) Submit token Token

5) Request token for application

Token for STS Y

4) Get token for Organization Y STS

Token for STS Y

Identity Federation (2)Organization X Organization Y

STS

Browser or Client

8) Use claims in token

AD FS 2.0

User

Active Directory Domain Services

3) Access application and

learn token requirements

5) Check policy for user, application X, and application Y

Application Y

WIF

1) Get token for

application X

Token for X

4) Request token for

application Y

Token for X

6) If policy allows, issue token for application Y

Token for Y

7) Submit token

Token for Y

2) Submit token

Token for X

Delegation

STS

Browser or Client Application X

WIF

Microsoft Technologies for Claims-Based Identity: A Closer Look

Changes in AD FS 2.0From the previous release

AD FS 1.1 supports only passive clients (i.e., browsers) using WS-Federation

And it doesn’t provide an STS

AD FS 2.0:Supports both active and passive clientsProvides an STSSupports both WS-Federation and the SAML 2.0 protocolImproves management of trust relationships

By automating some exchanges

CardSpace 2.0Selecting identities

CardSpace” provides a standard user interface for choosing an identity

Using the metaphor of cardsChoosing a card selects an identity (i.e., a token)

Information CardsBehind each card a user sees is an information card

It’s an XML file that represents a relationship with an identity providerIt contains what’s needed to request a token for a particular identity

Information cards don’t contain:Claims for the identityWhatever is required to authenticate to the identity provider’s STS

Identity Providers

STSSTSSTSBrowser or Client

CardSpace 2.0

User

Information Card 1

Information Card 3

Information Card 2

Information Card 4

Information CardsAn illustration

Creating Industry Agreement

The Information Card Foundation is a multi-vendor group dedicated to making this technology successful

Its board members include Google, Microsoft, Novell, Oracle, and PayPal

A Web site can display a standard icon to indicate that it accepts card-based logins:

Changes in CardSpace 2.0From the first CardSpace release

CardSpace 2.0 is available separately from the .NET Framework

It’s smaller and faster

CardSpace 2.0 contains optimizations for applications that users visit repeatedly

A Web site can display the card you last used to log in the site The CardSpace screen needn’t appear

Cards can be set using Group PolicyThe self-issued identity provider has been dropped

Windows Identity FoundationThe goal: Make it easier for developers to create claims-aware applicationsWIF provides:

Support for verifying a token’s signature and extracting its claimsClasses for working with claimsSupport for creating a custom STSVisual Studio project typesAn STS for development and testingMore

ConclusionsChanging how applications (and people) work with identity is not a small thing

Widespread adoption of claims-based identity will take time

Yet all of the pieces required to make claims-based identity real on Windows are here:

AD FS 2.0CardSpace 2.0Windows Identity Framework