Question

I have a need to implement a STS-IP server for our web applications and services. The server will need to issue SAML tokens for the following scenarios:

1. Business partner submits their SAML token which is converted to a SAML token with the claims required for our applications. This token is used to access our Web Applications and Services.
2. Our public facing applications need to have a user sign in (via forms authentication) and then access our web applications and services with a SAML token.
3. Our clients (without a STS trust) needs to authenticate with our STS-IP server, get a SAML token, and use that token to access our WCF services.

In all 3 scenarios, we need to have custom claims on the SAML token that our applications and services use. The thought is once we identify the user, we would look up their authorization in our back-end systems and attach claims.

In these scenarios, you can assume the back-end authentication store is a custom implementation with authentication stored in Active Directory and authorization stored in a database.

So my thought has been, we need to create a custom STS-IP server using something like Windows Identity Framework. But I have also been reading that you should not do this because it can take some time.

Can I use an off-the-shelf STS-IP server? Everything I’ve seen is a mapping between one system to another (SAML to SAML or AD to SAML).

Why will it “take a long time” to build a production ready STS-IP ? I built one using WIF very easily, but I guess I don’t understand the risks in doing this.

Answer 1

In terms of “It will take a long time”, the documentation showing how to do this is very poor. See here: http://social.msdn.microsoft.com/Forums/en-US/Geneva/thread/257d93be-165e-45a6-a277-fc7ed2286e7d/

Anyhow, you’ll simply need to look over the code samples that Microsoft provides: Google for Identity Developer Training Kit. That should help you get started.