One of the services provided by the Windows Azure cloud computing platform is the Windows Azure Access Control Service. The Windows Azure Access Control Service is a hosted service that provides federated authentication and rules-driven, claims-based authorization
Quoted directly from MSDN:
Windows Azure Access Control Service (ACS) is a cloud-based service that provides an easy way of authenticating and authorizing users to gain access to your web applications and services while allowing the features of authentication and authorization to be factored out of your code. Instead of implementing an authentication system with user accounts that are specific to your application, you can let ACS orchestrate the authentication and much of the authorization of your users. ACS integrates with standards-based identity providers, including enterprise directories such as Active Directory, and web identities such as Windows Live ID, Google, Yahoo!, and Facebook.
Available features on the Windows Azure Access Control Service:
- Integration with Windows Identity Foundation (WIF)
- Out-of-the-box support for popular web identity providers including Windows Live ID, Google, Yahoo, and Facebook
- Out-of-the-box support for Active Directory Federation Services (AD FS) 2.0
- Support for OAuth 2.0 (draft 10), WS-Trust, and WS-Federation protocols
- Support for the SAML 1.1, SAML 2.0, and Simple Web Token (SWT) token formats
- Integrated and customizable Home Realm Discovery that allows users to choose their identity provider
- An Open Data Protocol (OData)-based management service that provides programmatic access to the ACS configuration
- A browser-based management portal that allows administrative access to the ACS configuration
Now there is quite some stuff in the list above that I have no knowledge about. And to be honest, Security and Active Directory and so forth are not really my biggest interests. Security is a very important aspect, but I prefer to leave the hardcore stuff to the security people.
However that being said, integrating a website with the ACS to authenticate users against an identity provider like Windows Live ID, Google or Facebook is quite interesting. I know many of us have written websites before and using our own custom user store or a membership provider. We are holding sensitive data which is always a possible security leak. Integrating with an identity provider like Windows Live ID, Google or Facebook provides our users to experience the single sing-on experience and we do not have to worry about storing the sensitive data.
How many times have you not registered on some random website with a username and password that you can not remember anymore later ? Would it not be easier to identify yourself to all those websites with your Google or Facebook identity. It removes you from the hassle to remember all your different users and password and it lowers the risk of your credentials being exposed since your credentials will only be stored at identity providers such as Google or Facebook.
Continue reading →