Comments for Garrett's Tech Musings

Comment on Refreshing Claims in a WIF Claims-Aware Application by Anton

Anton — Fri, 11 Jun 2010 04:09:20 +0000

But how to sign out permanently so that user had to enter his login and password again?

Comment on Microsoft Releases ASP.NET MVC 2 Preview 2 by Garrett

Garrett — Thu, 14 Jan 2010 12:18:54 +0000

Here is the “official” word from Phil Haack:

“The RTM release of ASP.NET MVC will be included in the RTM release of Visual Studio 2010, which is slated for some time in March. The VS2008 version of ASP.NET MVC 2 might release earlier than that. We’re still working out those details.”

Comment on Microsoft Releases ASP.NET MVC 2 Preview 2 by Len Ocin

Len Ocin — Thu, 14 Jan 2010 04:18:56 +0000

It’s been a few months since MVC2 RC came out.
Any idea when a final version *safe* for production use will be available?

Comment on Modifying the AD FS 2.0 Passive Federation Endpoint by Garrett

Garrett — Tue, 12 Jan 2010 14:50:22 +0000

Well, I stand corrected. Travis, you were correct that there are PowerShell Cmdlets to perform AD FS 2.0 administration:

http://technet.microsoft.com/en-us/library/ee126138(WS.10).aspx

Looks like you can do the same endpoint configuration using PowerShell.

Comment on Modifying the AD FS 2.0 Passive Federation Endpoint by Travis Spencer

Travis Spencer — Thu, 31 Dec 2009 15:21:35 +0000

Ah yes, the metadata. Now, I see the problem and why this sort of thing is necessary. I’ve been configuring all my RPs by hand, so I didn’t think of that.

Comment on Modifying the AD FS 2.0 Passive Federation Endpoint by Garrett

Garrett — Wed, 30 Dec 2009 23:04:11 +0000

@Travis Spencer
Thanks for the feedback, Travis. All good thoughts.

1. We had originally done just as you said — pointed the IIS virtual directory to the custom application. This was with Beta 2 when the site was found under /FederationPassive. With the RC and the new /adfs/ls folder structure, it seemed a little messier to change a sub-folder so that’s when I started looking for a way to change the AD FS configuration. In the end, it may be a little more work, but it seems cleaner to me.

2. I hadn’t looked to see if there were any PowerShell methods, but if somebody finds one, that would be excellent.

3. If I’m following you correctly, I understand that the STS URI is fairly arbitrary from the RP standpoint. However, the Metadata “endpoint” in AD FS points the RP to /adfs/ls. Therefore, if you use FedUtil to setup the trust between your RP and AD FS, you will get the /adfs/ls address. This can be changed in the web.config manually, but that’s just another step for every RP app.

As far as using the out of the box login app as a starting point, that’s exactly what we did. I certainly like what Microsoft’s done with the Microsoft.IdentityServer library in the RC. It does make it fairly simple to roll your own AD FS sign-on pages. We’ve even gone as far as supporting OpenID and Facebook Connect in the login process.

Comment on Modifying the AD FS 2.0 Passive Federation Endpoint by Travis Spencer

Travis Spencer — Wed, 30 Dec 2009 22:31:03 +0000

Good post, Garrett. I have a couple questions though:

* Why not simply change /adfs/ls in IIS to point to your custom login app and change it back as needed? That sounds just as easy (if not easier) than running the SQL script against WID. Is it because of audience restrictions and other policy that ADFS will apply to incoming RSTs?

* Was there anything in the PowerShell API that would have allowed you to change this endpoint? A cursory look seems like no.

* The RPs are configured to point to an issuer w/ an arbitrary URI — anything not necessarily …/adfs/ls. So, whatever Web app that refers to is the passive STS that that RP will redirect subjects to. Why not use the API exposed by Microsoft.IdentityServer and the login app shipped w/ ADFS as a starting point/reference to build what you need? (This is what I’ve done.)

Comment on Top 10 Upcoming Microsoft Releases That Developers Should be Excited About by rtpHarry

rtpHarry — Fri, 11 Dec 2009 12:08:33 +0000

VS2010 and .net 4.0 are top of my list as well. After that I am really getting into the idea of EF4 and plan to adopt it as my main data access strategy when it is released.

Comment on The Inherent Flaw in Third-Party Authentication by Travis Spencer

Travis Spencer — Thu, 26 Nov 2009 18:08:36 +0000

You have the power to change this. If you and thousands of others boycott Facebook and Google (or at least their federated authentication services), perhaps they will begin providing users and businesses some form of SLA. If not, I imagine that alternatives will enter the market that do.

Comment on Architecture versus Code by Simon Brown

Simon Brown — Thu, 19 Nov 2009 20:44:48 +0000

Garrett : As an architect, it’s a matter of understanding your development team along with the project requirements. An “architecture astronaut” may overlook these factors, and this ultimately impacts the final deliverable — working code — which is what Grady Booch summarized much better than I could.

Agreed, there are many things that drive the architecture and that includes the available skill set.