0

i'm new to claims based security. I understand the premise but have some questions regarding the token.

From what I understand, the token will carry all of the claims for a given user, and that different systems will use different claims to determine authorization to a system. On this point I have several questions;

1) Does this mean that the STS is aware of all claims for all systems? Does this not mean the token could become gargantuan in size? Or does the token only carry the claims as needed by the relying party requesting the authentication?

2) Should claims be leveraged to determine fine grained access to a system, or are relying parties expected to maintain a separate means of tracking permissions?

I have a system with 100's of different user permissions. In trying to move to a claims based solution, the missing piece for me is, are all of the permissions meant to be managed by the STS and provided in the token? Or, do I use the token to authenticate the user, then manage permissions myself? Or perhaps some inbetween?

Help and guidance would be appreciated!

Kind regards TheMistry

4

1 回答 1

0

1) 使用 ADFS，每个 RP 单独配置一组声明。因此，用户只会获得该 RP 的声明。

2) / 3) 这是一个灰色区域。您可以将所有权限移至声明中。ADFS 允许来自 AD/LDAP/SQL Server 的声明。ADFS 还允许您将 AD 属性映射到角色。我通常做的是将所有基于角色的东西作为声明传递，这样 RP 就可以有像“IsInRole()”这样的代码，但其余的留给 RP 来处理。

于 2012-10-20T06:45:42.460 回答