locked
WCF rest services STS and JavaScript RRS feed

  • Question

  • Hello

    I want to have rest services that are claims enabled, the token should be issued by the STS after the user log in to the web app. This token shall be saved and used by JavaScript calls to the rest services. Is this possible? if so kindly provide a sample or explanation, since I have been through a lot of examples for STS and rest and trying to build this scenario but it seems very complex. I have spent a lot of time on this.

    Thank you in advance

    Regards,

    Moe


    • Edited by Don Hamdan Sunday, April 12, 2015 8:29 AM
    Sunday, April 12, 2015 8:20 AM

Answers

  • Hi Don Hamdan,

    >>I want to have rest services that are claims enabled, the token should be issued by the STS after the user log in to the web app. This token shall be saved and used by JavaScript calls to the rest services. Is this possible?
    Yes, it is possible, I will recommand you build the claims enabled WCF Services using WIF, the following is the scenario of it:
    WIF Basic Claims Aware WCF Service 

    In this way the client will use the WIF to send credentials to the STS and upon successful authentication, the agent is issued a token by the STS and the agent sends this STS-issued token to the WCF service.The claims enabled WCF service is configured to trust the STS and the tokens it issues. Besides, the claims enabled WCF service uses WIF to validate the token and to parse it.

    For more information, please try to refer to the following article:
    #Understanding Windows Identity Foundation (WIF) 4.5:
    http://www.codeproject.com/Articles/504399/Understanding-Windows-Identity-Foundation-WIF .  
    #Using WIF for securing REST Service:
    http://zamd.net/2010/07/31/using-wif-for-securing-rest-service/ .
    #Secure your REST-based WCF service with WIF:
    https://waysec.wordpress.com/2011/12/28/secure-your-rest-based-wcf-service-with-wif-part-1/ .

    Best Regards,
    Amy Peng


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.






    Monday, April 13, 2015 2:08 AM

All replies

  • Hi Don Hamdan,

    >>I want to have rest services that are claims enabled, the token should be issued by the STS after the user log in to the web app. This token shall be saved and used by JavaScript calls to the rest services. Is this possible?
    Yes, it is possible, I will recommand you build the claims enabled WCF Services using WIF, the following is the scenario of it:
    WIF Basic Claims Aware WCF Service 

    In this way the client will use the WIF to send credentials to the STS and upon successful authentication, the agent is issued a token by the STS and the agent sends this STS-issued token to the WCF service.The claims enabled WCF service is configured to trust the STS and the tokens it issues. Besides, the claims enabled WCF service uses WIF to validate the token and to parse it.

    For more information, please try to refer to the following article:
    #Understanding Windows Identity Foundation (WIF) 4.5:
    http://www.codeproject.com/Articles/504399/Understanding-Windows-Identity-Foundation-WIF .  
    #Using WIF for securing REST Service:
    http://zamd.net/2010/07/31/using-wif-for-securing-rest-service/ .
    #Secure your REST-based WCF service with WIF:
    https://waysec.wordpress.com/2011/12/28/secure-your-rest-based-wcf-service-with-wif-part-1/ .

    Best Regards,
    Amy Peng


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.






    Monday, April 13, 2015 2:08 AM
  • Thank you very much for the information provided. I will be implementing the above, if it was successful I will mark it as answer.
    Wednesday, April 15, 2015 4:56 PM
  • Hi Don Hamdan,

    I do not hear the information from you for some days, I will mark my reply as answer, if you feel it useless, please feel free to unmark it and post more information in here.
    Thanks for your understanding.

    Best Regards,
    Amy Peng


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.


    Thursday, April 23, 2015 8:13 AM