wcfclaims-based-identitysimplemembershiprole-based

Why Claim based authentication instead of role based authentication

I am new to claim based authentication. I have gone throught several aricles and could not able to figure out the exact use of claim based authentication. Here are some doubts I have about claim based authentication.

  1. I would like to know what is the difference and advantages of claim based over role based authentication.
  2. Can we connect to Sql Server 2008 R2 using claim based authentication instead of ADFS? If, so how?
  3. Advantage of using claim based authentication in WCF?

Can anyone provide me with some explanations, so that I can understand Claim based authentication and use with my application?

Solution

  • Ultimately the main benefits to using claims include:

    1. providing a consistent programming model for your services - you don't need to know how to implement a particular security mechanism, one site might use username and password authentication/authorisation, another Active Directory. You services don't care either way because all you are doing is processing the claims in all instances.

    2. You don't need to concern your self with the security implementation. This is done by a third party.

    3. you can customise claims to suit your domain, and treat them as an extension to your authorisation logic - standard security properties usually only provide you only with basic information such as roles. You can of course extend this but then your doing much more work and is often difficult to implement (eg. extending AD is often not so much a technical challenge but a policy constraint - admins are reluctant to modify the AD schema to accomodate a specifioc application).

    4. Interopable - because the claims [format] are based on standards they become much more interopable between services of different languages and domains as the underlying technology for the security is abstracted.

    If you are creating new .NET 4.5 WCF Services you can already start using claims as the namespace is backwards compatible with earlier security implementations, so even if you did decide claims wasn't for you now, you would be in a better position to upgrade later.

    There is much more to claims than I can write here and I'm sure there will be others with additionbal reasons why considering claims might be a good thing.

    Hope this helps.