Code Sample: WCF Federated Authentication With AD FS 2.0

Go to the Windows Azure Management Portal, sign in, and then click Active Directory.

To create an Access Control namespace, click New, click App Services, click Access Control, and then click Quick Create. (Or, click Access Control Namespaces before clicking New.)

To manage an Access Control namespace, select the namespace, and then click Manage. (Or, click Access Control Namespaces, select the namespace, and then click Manage.)

This action opens the Access Control Service management portal.

To add AD FS 2.0 as your identity provider, you will need your WS-Federation metadata document, which is hosted in your AD FS 2.0 server at /FederationMetadata/2007-06/FederationMetadata.xml. For example, if your AD FS 2.0 server is installed on a computer with the name contoso.com, then the metadata URL will be: https://contoso.com/FederationMetadata/2007-06/FederationMetadata.xml

If the server running AD FS 2.0 is accessible from the Internet and not placed behind a firewall, then you can use this URL directly. Otherwise, you will need to save this document to your computer and upload it to ACS when adding your identity provider.

Click Identity Provider and then click Add.

Select WS-Federation identity provider and click Next. Complete the form either by entering the URL or using the saved file, depending on the metadata document’s location.

To register your application with ACS, click Relying party applications, click Add, and enter the following information in the form:

• In the Name field, enter Federation Sample RP
  
  
• In the Realm field, enter http://localhost:7200/Service/Default.aspx
  
  
• In the Token format field, select SAML 2.0
  
  
• In the Token encryption policy field, select Require Encryption
  
  
• In the Identity Providers field, select the AD FS 2.0 identity provider added in the previous step
  
  
• For Token signing, select Use a dedicated certificate and select the ACS2SigningCertificate.pfx file, located in the Certificates folder of this sample. Enter a password of password.
  
  
• For the Token encryption certificate, select the WcfServiceCertificate.cer file in the Certificates folder of this sample and save the settings.
  
  

Click Save.

To create the rules that determine the claims that ACS will issue to your application, click Rule Groups. Select Default Rule Group for Federation Sample RP, click Generate, select AD FS 2.0, and then click Generate.

This process creates pass-through rules for AD FS 2.0 based on the claim types present in the WS-Federation metadata.

To add the decryption certificate, click Certificates and keys, and then click the Add link for Token Decryption. ACS uses this certificate to decrypt incoming tokens from the AD FS 2.0 identity provider.

In the Certificate field, browse to the Certificates folder of this sample and select ACS2DecryptionCert.pfx. The password for this certificate is password.

Click Save to complete the form.

To configure the sample, open SamplesConfiguration.cs (acs\Management\ManagementService\Common). Replace the placeholders in the SamplesConfiguration class in the Common class library with information about your Access Control namespace. You can find the information in the ACS Management Portal.

To navigate to the ACS Management Portal: Go to the Windows Azure Management Portal, sign in, and then click Active Directory. To manage an Access Control namespace, select the namespace, and then click Manage. (Or, click Access Control Namespaces, select the namespace, and then click Manage.)

• ServiceNamespace - Enter the name of your Access Control namespace.
  
  
• ManagementServiceIdentityName - Enter the name of an ACS management service account. The default is ManagementClient.
  
  To find the management service account name, in the ACS Management Portal, click Management service. The accounts are listed by name under Management Service Accounts.
  
  
• ManagementServiceIdentityKey - Enter the password for the management service account.
  
  To find the management service account password, in the ACS Management Portal, click Management service. Click the name of a management service account, and then, under Credentials, click Password. The password appears in the Password field. To copy the password, click Show Password.
  
  

Update the following metadata related settings in Program.cs in ConfigureSample:

• IdentityProviderMetadataUrl - This is the URL for the WS-Federation metadata of your AD FS 2.0. This setting can be found in the AD FS 2.0 console under Service\Endpoints.
  
  
• entityId - This is the issuer name that ACS will use for your AD FS 2.0 identity provider. In the metadata document, this is the entityID attribute’s value for the EntityDescriptor node.
  
  

Run the ConfigureSample application in Visual Studio. This will configure ACS to run this sample.

On the server running AD FS 2.0, open the AD FS 2.0 management console.

Expand Service and select Endpoints. Right-click the /adfs/services/trust/13/windowsmixed endpoint and enable it.

To restart the AD FS 2.0 service, open an elevated command prompt and type the following command net stop adfssrv && net start adfssrv

To add the relying party trust for ACS, right-click Relying Party Trusts and select Add Relying Party Trust.

In this wizard, you will enter your Federation metadata for ACS which is located at https://<your namespace>.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml. Note that this information can be also found in the Application Integration page of the ACS Management Portal.

To open the rule editor, follow the steps in the AD FS 2.0 configuration wizard (enter a display name, select Permit all users to access to this relying party). Before clicking Finish, ensure that the checkbox Open the Edit Claim Rules dialog is selected.

In the rule editor select Add Rule, click Next, and enter the following information:

• Enter a display name for the rule
  
  
• In the Attribute store drop-down list, select Active Directory
  
  
• In the LDAP Attribute column, select E-Mail-Addresses
  
  
• In the Outgoing Claim Type column, select E-Mail Address
  
  

To complete the wizard, click Finish.

Open the sample in Visual Studio. The solution consists of two main projects: WcfService and WcfClient.

If you have not already done so, enter your Access Control namespace details in Common\SamplesConfiguration.cs. For more information about the Access Control namespaceaof Option 2: Configuring via the ACS Management Service above. This file is also used by the WcfService and WcfClient projects.

Open the App.config files in the WcfClient project.

Enter your IdpEndpointAddress under the AppSettings element. You can find this information in your AD FS 2.0 endpoint settings. In a typical configuration, this address will be https://<your-server>/adfs/services/trust/13/windowsmixed. Below is a code snippet showing this area of the Client App.config file.

<appSettings>

   <!-- Idp configuration 

         This configuration depends on the idp binding used -->

   <add key="IdpEndpointAddress" value="https://contoso.com/adfs/services/trust/13/windowsmixed"/>

      <!-- Service configuration -->

   <add key="ServiceAddress" value="http://localhost:7200/Service/Default.aspx"/>

   <add key="ServiceCertificateFilePath" value="..\..\..\Certificates\WcfServiceCertificate.cer"/>

</appSettings>

Open the App.config file in WcfService project and set your IdpEndpointAddress with the same value you used to set the IdpEndpointAddress in Step 3:

<appSettings>

   <!-- ACS v2 configuration -->

   <add key="AccessControlSigningCertificateFilePath" value="..\..\..\Certificates\ACS2SigningCertificate.cer"/>

   <!-- Idp configuration 

         This configuration depends on the idp binding used -->

   <add key="IdpEndpointAddress" value="https://contoso.com/adfs/services/trust/13/windowsmixed"/>   

   <!-- Service configuration -->

   <add key="ServiceAddress" value="http://localhost:7200/Service/Default.aspx"/>

   <add key="ServiceCertificateFilePath" value="..\..\..\Certificates\WcfServiceCertificate.pfx"/>

   <add key="ServiceCertificatePassword" value="password"/>

</appSettings>

To run the sample, start the WcfService and then start the WcfClient. At the client, enter a string to reverse.