0 out of 6 rated this helpful - Rate this topic

How to: Configure Trust Between ACS and WCF Service Using Symmetric Keys

Published: April 7, 2011

Updated: January 4, 2013

Applies To: Windows Azure

Applies To

Windows Azure Active Directory Access Control (also known as Access Control Service or ACS)
Windows® Communication Foundation (WCF)
Representational State Transfer (REST)

Summary

This topic describes how to configure trust between your application and ACS. Trust is established by signing the tokens that are exchanged between your application and ACS.

Objectives
Overview
Summary of Steps
Step 1 – Navigate to the Token Signing Keys Section
Step 2 – Configure Trust Using Symmetric Keys
Step 3 – Review Trust-Related Attributes in web.config and the ACS Management Portal

Objectives

Become familiar with the trust management section on the ACS Management Portal.
Manage trust using X.509 certificates.
Manage trust using a symmetric key.
Verify the required configuration in web.config and on the Management Portal.

Overview

Establishing trust is required to properly exchange tokens between your application and ACS. Trust makes sure the tokens are not tampered with in transit and that they are issued by a trusted party. Trust is managed using either X.509 certificates or symmetric keys and is based on the configuration of the ACS Management Portal and the web.config configuration.

Summary of Steps

To establish and manage trust between WCF service and ACS follow these steps:

Step 1 – Navigate to the Token Signing Keys Section
Step 2 – Configure Trust Using Symmetric Keys
Step 3 – Review Trust-Related Attributes in web.config and the ACS Management Portal

Step 1 – Navigate to the Token Signing Keys Section

This step shows how to navigate to the trust management section on the ACS Management Portal.

To navigate to the section related to trust management on the Management Portal

Go to the Windows Azure Management Portal, sign in, and then click Active Directory.
To manage an Access Control namespace, select the namespace, and then click Manage. (Or, click Access Control Namespaces, select the namespace, and then click Manage.)
Click Relying party applications and then click a relying party application.
On the Edit Relying Party Application page, scroll down to the Token Signing Keys section.
Click the desired key

Step 2 – Configure Trust Using Symmetric Keys

This step shows how to configure and manage the trust between an ASP.NET web application and ACS using a symmetric key. Use a 256-bit symmetric signing key if you are building an application that uses OAuth WRAP.

To configure and manage trust using a symmetric key

Go to the Windows Azure Management Portal, sign in, and then click Active Directory.
To manage an Access Control namespace, select the namespace, and then click Manage. (Or, click Access Control Namespaces, select the namespace, and then click Manage.)
Click Certificates and keys and then select a key.
On the Edit Token Signing Certificate or Key page provide the following values:
1. Name: An arbitrary name of your choice.
2. Type: Select Symmetric Key.
3. Key: Click Generate to create a randomly generated 256-bit symmetric key.
4. Effective date: Specify the start date for the key in mm/dd/yyyy format.
5. Expiration date: Specify the ending date for the key in mm/dd/yyyy format.
Click Save.

Step 3 - Review Trust Related Attributes in web.config and the ACS Management Portal

This step shows how to validate trust-related configuration attributes in the web.config ASP.NET web application.

To verify trust-related configurations in the web.config ASP.NET web application

Open your web.config ASP.NET web application.
Navigate to the audiencesUris node and note the value of its child add node. The value must match the value of the Realm property on the Edit Relying Party page of the ACS Management Portal.
Go to the Windows Azure Management Portal, sign in, and then click Active Directory.
To manage an Access Control namespace, select the namespace, and then click Manage. (Or, click Access Control Namespaces, select the namespace, and then click Manage.)
Click Relying party applications and then click a relying party application.
Verify that the value of the Realm property on the Edit Relying Party Application page matches the value of the add node in the audienceUris node in web.config.