Exercise 3: Accepting Tokens from an Active Directory Federation Services (ADFS) STS

In this exercise you will modify the application from the previous exercise for accepting tokens from an existing Active Directory Federation Services (ADFS) STS. You can expect this to be by far the most common scenario in which you will take advantage of an STS: the Windows Identity Foundation makes this task very easy, thanks to its integration with Visual Studio and the use of federation metadata.

Note that in a real world scenario this task would require two steps:

• Configuring the RP application for accepting tokens from the STS
• Configuring the STS for issuing token for the RP application being developed

The current exercise focuses on the first step: the second step is unnecessary in our case. In order to make the lab more agile, we will take advantage of an instance of Active Directory Federation Services (ADFS) that is available through the Internet. Such an instance has been pre-provisioned with the data of the RP being used in this lab, hence it will start issuing tokens for us as soon as we will request them. For this reason, it is of key importance that the application URI and the certificates will follow exactly what is specified in the lab instructions.

Task 1 -Referencing an STS Published by an Instance of Active Directory Federation Services ( ADFS)

1. Open Microsoft Visual Studio 2010 with administrator privileges. From Start | All Programs | Microsoft Visual Studio 2010, right-click on Microsoft Visual Studio 2010 and select Run as administrator.
2. Open the ClaimsEnableWebSite.sln solution file located in the %YourInstallationFolder%\Labs\WebSitesAndIdentity\Source\Ex3-FederatingADFSv2\Begin folder.
   Note:

   The starting solution is based on the Exercise 1 solution. It contains a simple relying party and a local STS which will be modified to use an online STS.

3. On the Solution Explorer, right-click the https://localhost/ClaimsEnableWebSite project and select Add STS reference.
4. When the Federation Utility window shows up perform the following tasks for each step in the wizard.
   1. On the Welcome page click Next to continue using the pre-populated fields.

      

      Figure 34

      Welcome page

   2. On the STS options page, select the third option button ("Use an existing STS"), set the STS metadata location to https://ip-sts-01.federatedidentity.net/federationmetadata/2007-06/federationmetadata.xml and click Next.

      

      Figure 35

      Selecting a STS option

   3. Select Disable Certificate chain validation and click Next.

      

      Figure 36

      Disabling certificate chain validation

   4. Select the Enable encryption option and then select the Select an existing certificate from store option.

      

      Figure 37

      Using encryption with localhost certificate

   5. Click Select Certificate and select the certificate for localhost.

      

      Figure 38

      Selecting the certificate

   6. Click Next.
   7. In the Offered Claims page, click Next.

      

      Figure 39

      Offered claims window

   8. On the Summary page, review the changes and click Finish.

      

      Figure 40

      Summary

   Note:

   Now that our application receives claims from a production STS, the development STS (https://localhost/ClaimsEnableWebSiteEx03_STS project) is no longer necessary and can be removed from the solution.

Exercise 3: Verification

In order to verify that you have correctly performed all steps in the exercise three, proceed as follows:

1. Run the solution (https://localhost/ClaimsEnableWebSite project)
2. Sign in with the following user:
   • Username: frankm
   • Password: p@ssw0rd

   

   Figure 41

   Sign in Form Windows Identity Federation Online Server

3. If you have JavaScript disabled in your Web browser you will get a message as shown in Figure 1, click Submit to continue to the relying party.

   

   Figure 42

   Script is disabled message

4. You should be able to see the welcome message and days to birthday from previous exercise.

   

   Figure 43

   Welcome message in default page