0

I'm using Thinktecture Identity Server for SSO with some apps. The idea is that account information will be stored on the server in the claims information. So groups user membership and other hierarchies can exist on the SSO server. Then when some one authenticates they would get their membership and rights passed down through claims.

My question is how can my authentication subscriber perform a user.memberOf(x) kind of lookup? I can't imagine that the whole permission hierarchy gets passed down in a users claims. I imagine that additional queries would be performed against the sign on server like LDAP. How does this work for Thinktecture? Would it be the same generally for other SSO servers? If so what's the patterns name?

QueueHammer
  • 10,515
  • 12
  • 67
  • 91

2 Answers2

1

A general pattern is that, yes, you pass all roles in claims. This causes issues if there is too many groups but if this is so then it could be that the role model should be revisited.

Switching to oauth2-style authorization solves the issue: you don't pass claims in roles but then the relying party queries roles with an extra call. The drawback is that if the STS is further feredated with yet another STS, such extra calls become tricky as the call would require another internal call which would possibly require yet another call etc. Passing roles in claims means that there is no need for this extra call.

Yet another idea is switching to a custom STS that would issue claim roles filtered depending on the relying party or other user attributes. This could work as usually a single RP is not interested in all roles but rather a subset that makes sense there. Your filter is then implemented at the custom STS side.

Wiktor Zychla
  • 47,367
  • 6
  • 74
  • 106
  • I like the idea of filtering roles per RP. I'm quite to to claims, and this has been bothering me a bit. Thanks. – ProfK Nov 24 '14 at 19:58
0

Well - IdSrv is a custom STS. You can issue claims per RP - check this article (especially the part about IClaimsRepository):

http://leastprivilege.com/2013/05/17/customizing-identityserver/

leastprivilege
  • 18,196
  • 1
  • 34
  • 50