Demos from my TechEd talks

I enjoyed your session and the code you've made available. You spoke about claims transformation. Don't you need to sign the new claimset you've created? What if a client sends you a saml token with the exact same claims?

thanks

Lieven,

Glad you enjoyed the session. Claims transformation can happen in a lot of places. If it happens external to the application using the claims, e.g. in an STS, the issuer of the new claimset should absolutely sign the claims (WCF has plumbing to produce signed security tokens, which is how we ship around claims).

But if you're doing the claims xform right in your application, there's no need to sign anything; you just use a local identifier for the issuer (I used the "System" claimset in my example). The WCF plumbing that accepts claims from clients won't ever issue a "System" claimset, so as long as you're checking the issuer, you don't need to worry about someone faking your internal claimset.

HTH!