A Guide to Claims-Based Identity and Access Control: Authentication and Authorization for Services and the Web

by Vittorio Bertocci, Dominick Baier, Keith Brown

As systems have become interconnected and more complicated, programmers needed ways to identify parties across multiple computers. One way to do this was for the parties that used applications on one computer to authenticate to the applications (and/or operating systems) that ran on the other computers. This mechanism is still widely used-for example, when logging on to a great number of Web sites. However, this approach becomes unmanageable when you have many co-operating systems (as is the case, for example, in the enterprise). Therefore, specialized services were invented that would register and authenticate users, and subsequently provide claims about them to interested applications. Some well-known examples are NTLM, Kerberos, Public Key Infrastructure (PKI), and the Security Assertion Markup Language (SAML). Most enterprise applications need some basic user security features. At a minimum, they need to authenticate their users, and many also need to authorize access to certain features so that only privileged users can get to them. Some apps must go further and audit what the user does. On Windows®, these features are built into the operating system and are usually quite easy to integrate into an application. By taking advantage of Windows integrated authentication, you don't have to invent your own authentication protocol or manage a user database. By using access control lists (ACLs), impersonation, and features such as groups, you can implement authorization with very little code. Indeed, this advice applies no matter which OS you are using. It's almost always a better idea to integrate closely with the security features in your OS rather than reinventing those features yourself. But what happens when you want to extend reach to users who don't happen to have Windows accounts? What about users who aren't running Windows at all? More and more applications need this type of reach, which seems to fly in the face of traditional advice. This book gives you enough information to evaluate claims-based identity as a possible option when you're planning a new application or making changes to an existing one. It is intended for any architect, developer, or information technology (IT) professional who designs, builds, or operates Web applications and services that require identity information about their users.

Genres: Technology, Programming

148 pages, Paperback

First published April 14, 2010

Reviews

[Michael · Rating 3 out of 5]

Overall this book was very helpful in terms of understanding how to structure federated identity for applications. This sort of holistic approach (as opposed to detailed specifications about specific protocols) doesn't have as much literature as it should have. The main downsides to this book is that it is heavily laden with implementation specific details that don't age quite as well.

[Rob Martin · Rating 4 out of 5]

Chapter 9 'Securing REST Services' is still relevant today for the new comer to the world of Claims. Still, it has a strong WCF SOAP and WPF solution focus.

[Mohammad Shaikh · Rating 4 out of 5]

Excellent book on claims, learnt so many new things on developing an enterprise level application by using claims instead of by using identity system. Thanks a lot for sharing such great resource.

[Frank Boucher · Rating 4 out of 5]

This is definitely THE book to get started with claims. It starts right at the beginning explaining what’s a claim, why we should use it. Many different scenarios are presented. Each of them is presented with and without claims and most of the time how to migrate from one to the other. The complete solution is available on codeplex.com and if a PDF is good enough for you; it's also available on codeplex for free.

[André Fonseca · Rating 5 out of 5]

Well written with good examples, excellent for someone that doesn't know anything about claims.

Best of all, FREE

[Alex Ott · Rating 3 out of 5]

detailed introduction into Microsoft's claim-based identity solutions. Many very detailed examples...