Off-the-shelf Security Token Service (STS) that us

问题:

I'd like to move a site that currently uses the standard ASP.NET membership provider to use claims-based authentication through Windows Identity Foundation and Azure ACS.

We're going to surface the site using OAuth 2.0 secured REST services so this seems a sensible approach to follow. We also have a need to federate our authentication with external third-party ADFS and other systems, which is precisely the problem that ACS solves very well.

However, I would also like to retain the ability for our existing users to use their existing credentials.

To do this I think I need a custom STS that works with the ASP.NET Membership Provider.

All the literature (e.g. Bertocci's "Programming Windows Identity Foundation") suggests that it's a bad idea to write a custom STS. And, I agree -- I really don't like writing our own security code.

So - is there an STS available that can use Membership Provider data?

回答1:

Take a look at the Identity Server (http://identityserver.codeplex.com) which uses the SQL Membership Provider.

It's a custom STS, but it's robust, extensible, and well architected.

Update: The project page is changed to http://thinktecture.github.io/Thinktecture.IdentityServer.v2/ Code has moved to https://github.com/thinktecture/Thinktecture.IdentityServer.v2