Integrated Claims Based Authorization with Windows Identity Foundation

Question

I'm trying to evaluate whether to use classic Principal based authorization vs. IdentityModel authorization. It seems like Microsoft is recommending the latter these days, but I haven't seen enough in terms of maturity or support for it. Specifically, I really like the ability to set a PrincipalPermissionAttribute and allow the framework to automatically take care of preventing unauthorized class instantiation and method calls.

I am already using a ServiceAuthorizationManager and could perform evaluation there...but what about non-WCF scenarios? And what about preventing the instantiation of certain classes and preventing method calls within a WCF operation, not before it executes?

I am also already using an IoC mechanism and have contemplated using interceptors and a custom activator that performs claims based evaluation against a hypothetical RequiresClaimAttribute on a class or method...but I'm not really fond of such an approach because it requires any objects that want authorization support to use the IoC container for resolution and construction...

So I guess my question is...is Microsoft's Windows Identity Foundation (aka IdentityModel framework) really mature enough to use at this point? Are there ways of accomplishing what I'm describing with IdentityModel?

Answer 1

You can achieve all this with WIF. Among other things, WIF plugs into the .NET framework through IPrincipal and IIdentity interfaces. An app that is coded against these two, would probably "just work" (like most ASP.NET and WCF services). Roles, as an artifact for atuhorization is automatically mapped by WIF also so any frameowrk that calls IPrincipal.IsInRole, should work.

This example shows integration with "RIA Services" and explains a possible implementation (and extension) for a more general "RequiresClaimAttribute" as you suggest.

As to the maturity question. I guess it depends on how you define it. It's a relatively new addition to the .NET framework, but it is released and fully supported. I know of several (production) applications using WIF. Some bigger, some smaller, some in private sector and some others in government solutions. You will have to assess the applicability and suitability to your own context and constraints.