Question

We are implementing STS (claim based authentication) for the the REST based services. One of the reasons amongst many when we decide to create REST services (with JSON) was the small footprint over the wire. With STS, the SAML token with just a few claims the SAML size becomes few K bytes. For most of the REST calls where we are not returning list of objects, the response size is low 100s bytes and for those calls this token seems too much of overhead. How do you dealt with this in your projects?

Answer 1

You can use SAML tokens with REST endpoints, but more often you will find people using Simple Web Tokens (SWT) instead. Smaller, simpler, etc.

ACS (Access Control Service in Windows Azure PLatform) implements this, for example.