Clarity, Technology, and Solving Problems | PracticeThis.com
WP7 App with Key Windows Azure resources – Slides, Videos, How-To’s, and T-shooting – for quick consumption on the go.
The information in this post is based on Windows Identity Foundation Config.xml file that ships with WIF SDK.
<certificateValidation> controls the settings that token handlers will use to validate certificates, unless those handlers have their own validators set.
ATTRIBUTES
Example
<certificateValidation certificateValidationMode="PeerOrChainTrust" revocationMode="Online" trustedStoreLocation="LocalMachine" >
<certificateValidator> allows for a custom type to be specified for certificate validation. This type will only be used if the certificateValidationMode is set to "Custom"
<certificateValidator type="CustomType" />
<maximumClockSkew> Controls the maximum allowed clock skew when performing time-sensitive operations such as validating the expiration time of a sign-in session. Defaults to 5 minutes.
<maximumClockSkew value="00:05:00" />
<serviceCertificate> controls the certificate used for token decryption. In the case of an Information Card relying party, this should be the SSL certificate of the web site. Any certificate that is identified must have a private key and the private key must have appropriate access control permissions so that it may be read by the application pool identity.
Example:
<serviceCertificate> <certificateReference x509FindType="FindByThumbprint" findValue="97249e1a5fa6bee5e515b82111ef524a4c91583f" storeLocation="LocalMachine" storeName="My" /> </serviceCertificate>
Adding OpenID as identity provider using Windows Azure AppFabric Access Control Service (ACS) v2 Management Service is in general similar to the procedures outlined in the following posts:
The key differences are as follows:
// Create Identity Provider IdentityProvider identityProvider = new IdentityProvider() { DisplayName = identityProviderName, Description = identityProviderName, WebSSOProtocolType = "OpenId", IssuerId = issuer.Id }; svc.AddObject("IdentityProviders", identityProvider);
IdentityProviderAddress signInAddress = new IdentityProviderAddress() { Address = "https://www.myopenid.com/server", EndpointType = "SignIn", IdentityProvider = identityProvider, }; svc.AddRelatedObject(identityProvider, "IdentityProviderAddresses", signInAddress);
<wsFederattion> defines parameter settings for WS-Federation protocol STS. This affects the settings for the WSFederationAuthenticationModule.
<wsFederation authenticationType="wauth" freshness="45" homeRealm="http://homeRealm" issuer="i" policy="http://policy" realm="http://realm" reply="http://reply" request="http://request" requestPtr="http://requestPtr" resource ="http://resource" requireHttps="true" passiveRedirectEnabled="true" persistentCookiesOnPassiveRedirects="true" signInQueryString="abc=xyz" signOutQueryString="def=uvw" signOutReply="http://signoutreply" />