by Amit Wadhwani
8. February 2012 07:53
What is Windows Azure Access Control System?
- Tool for authenticating and authorizing users for a website service
- Integrate single sign on (SSO) and centralized authorization into your web applications
- Compatible with most modern platforms, and integrates with both web and enterprise identity providers
- Integrates with Windows Identity Foundation (WIF) and tooling
- Logon using popular web identity providers including: Windows Live ID, Google, Yahoo, and Facebook
- Integrated and customizable Home Realm Discovery that allows users to choose their identity provider
- Supports protocols like: OAuth, Open ID, WS-Federation, and WS-Trust and many more
- Web portal based access to administrative ACS configuration
- Support for the SAML 1.1, SAML 2.0, and Simple Web Token (SWT) token formats
- Support for Active Directory Federation Services 2.0
Behind the Scene – Defining AppFabric ACS as Identity in SharePoint 2010
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("c:\your_token_signing.cer")
$map1 = New-SPClaimTypeMapping "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Email" -SameAsIncoming
$realm = "your-realm"
$signinurl = "https://your-service-namespace.accesscontrol.appfabriclabs.com/v2/wsfederation"
New-SPTrustedIdentityTokenIssuer -Name "Azure ACS" -Description "Windows Azure ACS v2" -Realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map1 -SignInUrl $signinurl -IdentifierClaim $map1.InputClaimType
New-SPTrustedRootAuthority -Name "Azure Test Token Signing" -Certificate $cert
Benefits
- Users do not need to remember quirky passwords
- Make them login with the credentials they use most often
- Only 25% people prefer registering online to access services
- 66% people prefer single sign on (SSO) for accessing websites
- Increase business revenue by providing easy access to your web services
Potentials
- Set permission levels for users in SharePoint
- Unified login for ASP.NET based sites
- Display user attributes like first name, last name, date of birth etc. as disclosed by the user to the intermediate identity provider
- Compatible with most browsers and platforms