Azure ACS - Best Practice Implementation

Question

We are building an ASP.NET MCV 3 application from scratch running on Windows Azure. About Authentication and Authorization layer we are thinking to use the Access Control Service. I went through some articles about ACS where I got the basic idea but I still have some doubts on it.

My understanding is that using the ACS we outsource the Authentication process to one or more Identity Providers (IP), basically we trust another system (i.e. Microsoft Live ID) to authenticate our users.

The basic process is very straightforward: at authentication stage we redirect (ACS does it) the user to one of our “trusted” IPs, that will redirect the user (with a valid token) to the ACS and eventually to our application.

Here comes a number of questions:

Since we don’t want that all the users with a Live ID account can access to our application, I presume there should be another process to validate that user and checking if he is registered in our application. The question is where? In the ACS or in our application?

I have an idea about this but I don’t know if it’s the right way to do it:

At registration stage, the system (our web app.) asks the user which IP (i.e. Live ID, Google, Facebook, and our app.) he wants to use to authenticate himself in the application. Then the user goes through the authentication process on the IP system and when he comes back, we store his username (IP username) in our DB. So, next time, at authentication stage we can check if that user is registered in our system.

If the above theory is correct, that means in our app. we need to build our membership provider to store usernames coming from IPs and users that chose our app. as IP. Am I correct? What is the best practice to design the above process?

Now let’s talk about Authorization and “Roles”. How does it work with ACS? Does ACS manage multiple roles per user?

Again my understanding is that with ACS you can create a number of “Rule groups” related to the IP and not to a single user. If this is correct, how do we manage users in role in our application? Let’s say, for example, that we have multiple roles and our users can be associated to those roles, can we use ASC to manage it?

So the final questions are: Does ACS itself cover the whole Authentication and Authorization process? Do we still need to use the .net Membership Provider? What's the best practice in order to cover our requirements?

Chemise

Answer 1

For the part of the question about the registration stage, the best thing to use to identify users is the NameIdentifier claim type

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier.

This should be unique for each identity provider and also fixed. If you use the email address claim, it could change for the same user. Technically it could be possible for two identity providers to use the same NameIdentifier (none of the out-of-the-box ones with ACS do) so you could combine the NameIdentifier claim with the IdentityProvider claim type

http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider

to guarantee uniqueness.

For the part about role, I would say using ACS to issue role claims from generic identity like Google would be quite hard to manage using the claim transformation rules in ACS on per user basis. You would have to add a rule for each registered user - probably not feasible. I think the ACS rule groups are more suited to transformation of role claims (e.g. issued by a federated ADFS). Your idea to do it in your application is a better one IMHO. In code, the place to do this using WIF is in a custom ClaimsAuthenticationManager. You override its Authenticate method and based on the NameIdentifier claim from the incoming principle, you look up in your membership datastore and create a new IClaimsPrinciple based on the roles that are in your membership DB (i.e. you add a role claim for each role the user is in).

You then make your authorization decision in a custom ClaimsAuthorizationManager. There are some good samples and info on this around on the web. You can start at

http://msdn.microsoft.com/en-us/library/ee748497.aspx

Earthlight

Answer 2

The user validation process is done with claims.

After you set up an IP with ACS, when users authenticate, ACS will get claims about the authenticated user from the IP. You need to configure rules in ACS to say which claims you want forwarded on to your application. You can also tranlate claims into different types, to normalize the incoming claim set to what your application expects

If you want to implement your role based access with ACS, you can. In this case a role just another claim ACS will issue, and you'll implement your application to give user privileges based on the role claim it receives from ACS.

You can configure ACS rules that map certain IP input claims to role output claims. ACS also has a management service that can change these rules so you can implement a user registration process.

Individual claim rules in ACS relate to identity providers that issue the claim, but rule groups don't. Rule groups associate to RPs (your applications). A rule group is simply a group of claims transformation rules that tell ACS: "for this application, apply this rule group policy when you issue the token".

The ACS docs have lots to say about ACS claim rules configuration, both through the web portal and through the management service::

https://msdn.microsoft.com/library/azure/hh147631.aspx

Expanded response:

Let's say you're using ACS to authenticate to an ASP.NET app that's using WIF. You would configure ACS to issue a Role claim of "Manager" for the google user with email "[email protected]".

Now in your ASP.NET app, WIF will see this role claim and it will allow you to control access using either HttpContext.Current.User.IsInRole("Manager"), or the web.config equivalent.

You can manage these ACS rules manually using the web UI, or you can implement a registration process that adds such rules to ACS programatically using the ACS management service. There are some ACS management service samples available at acs.codeplex.com.

Also, the identity developer training kit has some examples on WIF role based access:

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14347

Strapped

Andrew many thanks for your answer. So about roles in ACS I was correct, basically we cannot associate a user to a role, as we can do in the .net membership provider (UsersInRoles), but we can associate a role based on the IP. What about at registration stage? What should we store in our database in order to recognize a user (as part of our customers) at authentication stage? – Chemise

No, what I'm saying is you can associate users to roles using ACS. I've expanded my response above to cover this. – Strapped