Securing Web Applications with ACS

Updated: June 19, 2015

Applies To: Azure

Scenario

In this scenario a web application needs to integrate with a third-party authentication identity management system.

There are several challenges associated with the scenario:

• How to redirect unauthenticated requests to the required identity provider?

• How to validate the incoming token issued by the identity provider?

• How to parse the incoming token?

• How to implement authorization checks?

• How to transform tokens by adding, removing, or changing the claims types and values?

• How to do all of the above using configuration rather than coding?

Solution

Microsoft Azure Active Directory Access Control (also known as Access Control Service or ACS) provides a solution to the scenario as depicted in the following image.

• Windows Identity Foundation (WIF) is used to redirect unauthenticated requests to ACS. ACS redirects the requests to the configured identity provider.

• Windows Identity Foundation (WIF) is used to validate incoming tokens.

• Windows Identity Foundation (WIF) is used to parse the incoming tokens.

• Windows Identity Foundation (WIF) is used to implement authorization checks.

• The ACS rule engine is used to transform tokens.

• Most of the work is done using the configuration either in the application’s web.config or/and through the ACS Management Portal.

Solution Summary

See Also

Concepts

Scenarios and Solutions Using ACS