Evolving of ASP.NET Identity System

ASP.NET Membership Provider

• First introduced in 2005
• Uses SQL Server database or Active Directory 
• See how to use ASP.NET membership provider

SqlMembershipProvider
Manages Membership information in a SQL Server database

ActiveDirectoryMembershipProvider
Manages and store membership information in Active Directory.

LDAP  (Lightweight Directory Access Protocol) : Is a protocol used to talk to AD (Difference between AD and LDAP)

Both providers above implements MembershipProvider class. Also see how to use AD and SQL providers together here and here.

ASP.NET Simple Membership

Membership system for ASP.NET Web Pages
Can't use with OWIN
Doesn't work well with existing ASP.NET membership providers

ASP.NET Universal Providers

Persist membership information on Windows Azure SQL Database
Can be used to persist data in any store built on Entity Framework
Built on ASP.NET membership infrastructure
http://www.asp.net/identity/overview/migrations/migrating-universal-provider-data-for-membership-and-user-profiles-to-aspnet-identity

ASP.NET Identity

One ASP.NET identity system
Unit testability
Ease of plugging in profile data about the user
Role provider and claim based
Social login providers
Windows Azure Active Directory
OWIN integration
NuGet package

DotNetOpenAuth
http://stackoverflow.com/questions/tagged/dotnetopenauth

Resources
Windows Identity Foundation 
Introduction to Membership
Membership class
http://brockallen.com/2013/10/20/the-good-the-bad-and-the-ugly-of-asp-net-identity/
http://stackoverflow.com/questions/21207246/asp-net-identity-vs-simple-membership-pros-and-cons
http://brockallen.com/2012/09/02/think-twice-about-using-membershipprovider-and-simplemembership/
http://weblogs.asp.net/jongalloway/simplemembership-membership-providers-universal-providers-and-the-new-asp-net-4-5-web-forms-and-asp-net-mvc-4-templates

Read More

Windows Identity Foundation

http://dotnetcodr.com/tag/claims/page/2/

How to create a Claim
      Claim claim1 = new Claim("Name", "User1");

You can also use enumeration ClaimTypes offered by WIF to give name for the claim (This is not actually a enum. It is a static class with const fields).

     Claim claim2 = new Claim(ClaimTypes.Country, "Sri Lanka");

You can create IIdentity object using set of claims easily.

            Claim claim1 = new Claim(ClaimTypes.Name, "User");
            Claim claim2 = new Claim(ClaimTypes.Country, "Sri Lanka");
            IList<Claim> claims = new List<Claim> { claim1, claim2 };

            ClaimsIdentity claimsIdentity = new ClaimsIdentity(claims);

If you look at the source of ClaimsIdentity class, you can see that DefaultIssuer of this class is "LOCAL AUTHORITY". You need to give authentication type to make ClaimsIdentity authenticated (see here). 

After creating ClaimsIdentity you can create ClaimsPrincipal which wraps Identity object. 

     ClaimsPrincipal principal = new ClaimsPrincipal(claimsIdentity);

Since ClaimsPrincipal implements IPrincipal, you can set Thread.CurrentPrincipal or HttpContext.User to principal object (check this, HttpContext User vs Thread CurrentPrincipal and Thread CurrentPrincipal Identity vs HttpContext User Identity). 

Claims Transformation

Membership.ValidateUser 

validates against Membership provider defines inside web.config

Also you can go through this wondeful 7 hour workshop about WIF.

http://www.cloudidentity.com/blog/2010/06/23/ALL-WILL-BE-REVEALED-7-HOURS-RECORDINGS-FROM-THE-WIF-WORKSHOPS/

WIF Code Samples provided by MSDN.

Latest release of ASP.NET Identity 2.0.0
http://blogs.msdn.com/b/webdev/archive/2014/03/20/test-announcing-rtm-of-asp-net-identity-2-0-0.aspx

Resources

http://msdn.microsoft.com/en-us/library/system.web.security.membership.validateuser(v=vs.110).aspx

http://msdn.microsoft.com/en-us/library/hh873308(v=vs.110).aspx

http://msdn.microsoft.com/en-us/library/hh873305.aspx

http://msdn.microsoft.com/en-us/security/aa570351.aspx

http://msdn.microsoft.com/en-us/library/ff359108.aspx

Read More

Concepts in Windows Identity Foundation

WIF involves lot of related concepts.

IIdentity
Usually represents the user. This interface is implemented by GenericIdentity and WindowsIdentity classes.

Identity Objects encapsulates information about the user or the entity. It basically contains a name and an authentication type. The name can be user's name or Windows account. .All Identity classes implement IIdentity interface. 

IPrincipal

IPrincipal represents the security context of the user. It has Identity property which returns identity of current principal. 

Here's a class diagram of WIF, extracted from MSDN

Comparison between Principal vs Identity Objects

• Managed code can discover identity or role of principal through Principal object. Principal object contains reference to an Identity object. 
• You can compare Identity and Principal objects to similar concept like User and Group Accounts.
• In .NET, Identity objects represents users and roles represent membership and security context
• Principal object encapsulates both identity object and a role.

ClaimsIdentity (inherits IIdentity)

Represents a claim based identity. It is a concrete implementation of claim based identity (Identity described by a collection of claims) The Claims contained in a ClaimsIdentity describes a entity that identity represents and can be used for authorization and authentication decisions.

The ClaimsPrincipal has a Claims property as well. In majority of cases you should access users Claims through ClaimPrincipal.Claims collection.

ClaimsPrincipal (inherits IPrincipal)

An IPrincipal implementation that supports multiple claim based identities. It has Claims property (IEnumerable) which has claims from all claim identities associated with the claims principle.

If you're implementing your own identity or principal objects you should implement ClaimsPrincipal or ClaimsIdentity. 

Accessing ClaimsPrincipal from HttpContext

Cast HttpContext.Current.User to a ClaimsPrincipal and access Claims

Claim
Claim is a piece of identity information. Usually you don't look up for claims. User delivers claims to your application. Claims are made by an issuer. Issuer can be your company therefore you trust the claims. Claim class has an issuer property which you can use to see who issued them. 

Security Token
User delivers set of claims to your application with a request. Later this might be cached in a cookie to read for consequent requests. Security token is a serialized set of tokens that is signed by an issuing authority. The signature is important. 

Issuing authority
This can be domain controllers that issue Kerberos tickets, authorities that issue X.509 certificates. Basically issuing authority is responsible to authenticate users for you.

Security Token Service 
Service that builds, signs and issues security tokens (according to WS-Trust and WS-Federation protocols). There are pre-built token services such as ADFS, cloud STS such as Windows Azure Access Control service etc.

You can built your own STS to issue custom tokens using WIF.

Relying Party
When you are building an application that uses claims, you're building a relying party (RP) application. (claims aware application, claim based application etc.). RP uses claims to do identity related activities. WIF fully supports this

Resources
https://msdn.microsoft.com/en-us/library/hh873308(v=vs.110).aspx

http://dotnetcodr.com/2013/02/14/introduction-to-claims-based-security-in-net4-5-with-c-part-2-the-new-inheritance-model/

http://www.asp.net/identity/overview/extensibility/overview-of-custom-storage-providers-for-aspnet-identity

https://www.youtube.com/watch?v=VcQrqqyUA2A
http://dotnetcodr.com/tag/claims/page/2/
https://stack247.wordpress.com/2013/04/18/net-4-5-claims-and-tokens-as-standard-model

Read More