In WCF/WIF how to merge up claims from two different client's custom sts's tokens

Question

I'm trying to create something like: Client authenticates and gets token from custom STS1, next client authorizes with machine key and is issued token on custom STS2 and gets another token. With last token, client requests methods on RP service.

All services are hosted on IIS and are using active federation scenario. Both STS's have endpoints with ws2007Federation and ws2007Http bindings, and RP use ws2007FederationBinding with STS2 as an issuer.

If I create channel with CreateChannelWithIssuedToken I can see only token from STS1 and can't get token from STS2.

So I decided to pass token from STS1 as ActAs RST's property on request to STS2 token. And that failed - cannot decrypt token.

1. How can I pass both tokens to STS2 and merge up claims in them?
2. Is it a bad idea - to send with RST just extracted claims from STS1 token?

Answer 1

Generally you will only want to utilize one token at each step. So if you need to merge up claims, you will want to do that at the claims transformation step of the second STS.

So the flow would be authenticate with STS1, then authenticate with STS2 with the token from STS1. At that point you would pass through the claims and transform to add additional claims as needed. Then the resulting Token would be ready to consume from the RP application.

I have actually started a blog series about a really similar scenario that we recently architected. Not to be overly self promoting, but it doesn't make me any money, so I'll post it in case it is helpful.

http://www.livingthearchitecture.com/mixing-sso-with-existing-technologies/

I would be glad to go more in depth, but depending on the specifics of your scenario, the specifics of the solution will change greatly. I think the above expresses the general approach you will want. Let me know if I can help any more.