Security Design with Claims-Based Authentication

2. OSP431 Security Design with Claims-Based Authentication Israel Vega, Nathan Miller

3. Session Objectives and Takeaways • Session Objective(s): • Quick review of claims based authentication with SharePoint and Azure • Discuss common claims based security scenarios • Assumptions • You understand claims, SAML and authentication protocols • You have set up claims based authentication with SharePoint • You understand ADFS and General Identity Federation • Bonus – You have built a SharePoint CCP

4. Agenda and Demos • Quick level-set of SharePoint claims and federation • Common Scenario • Demo: Authenticate AD Users via ADFS - ADFS/AD CCP • Migrate from classic to claims • Code: Migrate a web application from classic to claims • Fun with claims • Demo: Temporary File Sharing - TempShare CCP • Demo: Profile Claims - Profile Claims CCP

5. Along the Way • General CCP and Planning Guidance • General Tips and Tricks

6. Getting Claimed Securing with Claims & Getting Claimed Securing with Claims ClaimType = Value ClaimType = Value Federation Gateway SharePoint SP Security IN Incoming Claims OUT Mapped Claims In Out Transformation Augmentation Augmentation

7. Must Answer Questions for Planning • How will users be authenticated? • How will users be authorized? • Who will manage user accounts and provisioning? • Is the ID enough for AuthZ or do I need more information? • Are multiple ID’s per user allowed? • Do I really need a CCP and if so, which features? • Do I really need a custom STS?

8. Fundamental Principles of SharePoint and Claims • If you don’t have it at authentication time, you can’t use it for authorization • Know the difference between incoming claims vs. mapped claims • User identity is determined by authentication method (by default) • Public federation is not the same and private federation • SP claim security rules are evaluated as “OR” not “AND” Key Point: Federation relationships are based on trust

9. What is a SharePoint Trusted Identity Token Issuer? $map1 = New-SPClaimTypeMapping -IncomingClaimType "http://.../upn" -IncomingClaimTypeDisplayName "UPN" -SameAsIncoming $map2 = New-SPClaimTypeMapping -IncomingClaimType "http://.../nameidentifier" -IncomingClaimTypeDisplayName“NameId" –MappedClaimType “http://.../username” … $spTIp = New-SPTrustedIdentityTokenIssuer -Name “NAME" -Description “DESC" -Realm “REALM” -ClaimsMappings $map1 …" Trusted Identity Token Issuer Claims Provider Claims Mappings Login

10. What Do I Get With a Custom Claim Provider (CCP)? Trusted Identity Token Issuer Claims Provider Claims Search Claims Mappings Claims Resolve Login Claims Augmentation

11. How Does it Fit Together? Trusted Identity Token Issuer Claim Providers People Picker Custom CCP OOTB Active Directory Incoming Mapped Claims SharePoint (*) SP Identity Encoded Claims Encoded Claim

12. Associating a CCP to a Zone • $webAppUrl = "" • $webAppZone= "" • $claimProviderName = "" • write-host "Getting the web application urls to configure" • $altUrls = Get-SPAlternateURL • write-host "Getting the claim provider" • $claimProvider = Get-SPClaimProvider -Identity $claimProviderName • foreach($altUrl in $altUrls) • { • if ($altUrl.Zone -eq $webAppZone) • { • $wa = Get-SPWebApplication $altUrl.PublicUrl • write-host "Registering claim provider [$claimProviderName] for ["$webAppUrl"] on the zone ["$webAppZone"]" • $waIISSettings = $wa.GetIisSettingsWithFallback($webAppZone) • $waIISSettings.ClaimsProviders.Add($claimProvider) • $wa.Update() • } • } Stored as a collection with the other SP Web App Settings for the Zone

13. A Bit About Claims Encoding • Farm Specific • Custom claim type encoding starts at Unicode 500 • Immutable List - once mapped, cannot un-map • Values are evaluated in lower case Claim Encodings ASCII Decimal Code 504 Reserved Claim Type Reserved Claim Type ASCII Decimal Code 507

14. Reserved Claim Types and Identifiers

15. The Scenario - ADFS AD Claim Provider • Use Active Directory to maintain user accounts but use ADFS to authenticate • Need to search and resolve users just like native SharePoint • Must work across forests • Need to integrate with external partners using public and private federation • Need to block access to external users for certain data Trusted Provider  CCP Search  CCP Resolve  CCP Augmentation

16. Recipe – ADFS AD Claim Provider • 1 Custom Claim Provider • 1 Secure Store • 2 Active Directories • 2 SharePoint Sites • 1 ADFS Internal AD Secure Store People Picker SharePoint Secret Data ADFS Trusted Provider Claim Provider Super Secret Data External AD

17. Demo ADFS/AD Claim Provider Nephophobia (cloud fear, cloud phobia, fear of clouds, phobia of clouds)

18. The Scenario – Claims Migration • Existing SP 2007 or 2010 site is classic or FBA • Moving to SAML with a custom CCP Today’s talk Today’s talk Today’s talk  = Requires IMigrateUserCallBack

19. Code Snippets Claims Migration Scenarios The penguin is the only bird who can swim, but cannot fly

20. Migrating from Classic to Windows Claims • $webAppUrl= "http://yourWebAppUrl" • $adminAccount= “DOMAIN\ADMIN" • #Get the Web application • $webApp= get-SPWebApplication$webAppUrl • Set-SPwebApplication$wa -AuthenticationProvider (New-SPAuthenticationProvider) -Zone Default • #Re-Get the Web application • $webApp = get-SPWebApplication$webAppUrl • $adminClaim = New-SPClaimsPrincipal -identity $account -identitytype 1 • $adminClaimString= $adminClaim.ToEncodedString() • #Add the admin account to the web application policy • $zp = $webApp.ZonePolicies("Default") • $p = $zp.Add($adminClaimString,“Admin Policy") • $fc=$wa.PolicyRoles.GetSpecialRole("FullControl") • $p.PolicyRoleBindings.Add($fc) • $wa.Update() • #Re-Get the Web application • $webApp= get-SPWebApplication$webAppUrl • #Migrate the web application • $wa.MigrateUsers($true) Create an admin claim for myself Let me in after the migration Do the migration

21. Recipe –Custom Claims Migration • 1 Custom Claim Provider(If SAML) • 1 Custom Class: IMigrateUserCallBack • 2 SharePoint Web Apps • 1 Classic Content DB • Time and Patience 2) Mount to “DUMMY” Web App 5) Mount to “REAL” Web App Classic Web App Temporary Web App Permanent Web App 4) Copy Migrated DB 3) Migrate with IMigrateUserCallback 1) Copy DB Classic Content DB Classic Content DB Migrated Content DB

22. Migrating from Classic to SAML Claims Do the migration but pass the assembly reference • …See other slide - OMMITTED • #Migrate the web application • #Pass the Fully qualified Assembly reference • $wa.MigrateUsers(IMigrateUsersCallBackAssembly)

23. Migrating User Accounts Using IMigrateUserCallBack • Using … • usingMicrosoft.SharePoint.Administration.Claims; • publicclassSAMLMigrationCallback : IMigrateUserCallback • { • publicstringConvertFromOldUser(stringpreviousUserAccount, SPWebApplication.AuthenticationMethodpreviousAuthType, boolisGroup) • { • stringnewUserId = previousUserAccount; • SPClaimmigratedUserClaim = null; • switch (previousAuthType) • { • caseSPWebApplication.AuthenticationMethod.Windows: • { • migratedUserClaim = evalClassicToClaimsAccount(previousUserAccount, isGroup); • break; • } • caseSPWebApplication.AuthenticationMethod.Claims: • { • migratedUserClaim = evalWindowsClaimToClaimsAccount(previousUserAccount, isGroup); • break; • } • caseSPWebApplication.AuthenticationMethod.Forms: • { • //code for converting from Forms would be here • break; • } • } • if(migratedUserClaim != null) • { • newUserId= migratedUserClaim.ToEncodedString(); • } • returnnewUserId ; • } • } Called for each User Account being migrated Helper Functions SPClaimevalClassicToClaimsAccount(stringpreviousUserAccount, boolisGroup) { SPClaimmigratedClaim = null; returnmigratedClaim; } SPClaimevalWindowsClaimToClaimsAccount(stringpreviousUserAccount, boolisGroup) { SPClaimmigratedClaim = null; //migrating from Windows claims to SAML claims returnmigratedClaim; }

24. Migrating From Classic to SAML Claims • SPClaimevalClassicToClaimsAccount(stringpreviousUserAccount, boolisGroup) • { • SPClaimmigratedClaim = null; • SecurityIdentifiercurSid = newSecurityIdentifier(previousUserAccount); • //Check the SID and make sure its not a system type SID See http://support.microsoft.com/kb/243330 • if (curSid.IsWellKnown(WellKnownSidType.AuthenticatedUserSid) || • curSid.IsWellKnown(WellKnownSidType.LocalSystemSid)) • { • returnmigratedClaim; • } • else • { • if (isGroup) • { • stringoldNtId = translateSidToName(previousUserAccount); • if (oldNtId != null) • { • //Migrate Groups • migratedClaim = generateGroupSidClaimFromNtId(previousUserAccount); • } • } • else • { • migratedClaim = generateUserIdClaimFromNtId(oldNtId); • } • } • returnmigratedClaim; • } DO NOT MIGRATE NT AUTHORITY\Authenticated Users or LOCAL SYSTEM Group SIDS vs Names ??

25. Migrating From Windows Claims to SAML • SPClaimevalWindowsClaimToClaimsAccount(stringpreviousUserAccount, boolisGroup) • { • SPClaimmigratedClaim = null; • //Migrating from Windows claims to SAML claims - create a claim from the identifier so we can see if the original issuer came from Windows • SPClaimidClaim = _cpm.ConvertIdentifierToClaim(previousUserAccount, SPIdentifierTypes.EncodedClaim); • //this is a Windows claims user, and we are going to convert to a SAML claims user ID format • if (SPOriginalIssuers.IsIssuerType(SPOriginalIssuerType.Windows, idClaim.OriginalIssuer)) • { • //windows claims users will be in the format domain\user windows claims groups will be in the SID format • if (idClaim.ClaimType.Equals(SPClaimTypes.UserLogonName)) • { • migratedClaim = generateSAMLClaimFromNtId(idClaim.Value, SourceAccountType.WindowsClaim); • } • elseif (idClaim.ClaimType.Equals(Microsoft.IdentityModel.Claims.ClaimTypes.GroupSid)) • { • //Group SID or Group Name??? • migratedClaim= generateSAMLGroupClaim(idClaim.Value, SourceAccountType.WindowsClaim); • } • } • returnmigratedClaim; • } Helper Functions SPClaimgenerateSAMLClaimFromNtId(stringwinClaimId) { SPClaimmigratedClaim = null; //Create the proper SAML ID Claim for the old windows claim user returnmigratedClaim; } SPClaimgenerateSAMLGroupClaim(stringgroupClaim, boolisGroup) { SPClaimmigratedClaim = null; //Create the proper SAML ID Group claim for the old windows claim group returnmigratedClaim; }

26. Migration Notes • Imigrate user • Some accounts should not migrated • Local system • Some accounts should be migrated to anonymous • Must reconfigure the super user and search post migration • Logon as PortalSuperUser and PortalSuperReader at least once

27. Configuring the Publishing Cache Accounts • For Windows and SAML Claims, this must be configured for publishing sites • Set portalsuperuseraccountand portalsuperreaderaccount web application properties • Also configure the web app policy

28. Setting the Portal Super * Accounts Encoded Windows Claim (User Logon Name) • $PortalSuperReader = “domain\portalsuperreader" • $PortalSuperUser = “domain\portalsuperuser“ • $wa = Get-SPWebApplication –Identity “<<web app URL>>“ • $PortalSuperUserClaim = New-SPClaimsPrincipal -Identity $PortalSuperUser -IdentityTypeWindowsSamAccountName • $PortalSuperUserClaim.ToEncodedString() • $wa.Properties["portalsuperuseraccount"] = $PortalSuperUserClaim.ToEncodedString() • $PortalSuperReaderClaim = New-SPClaimsPrincipal -Identity $PortalSuperReader -IdentityTypeWindowsSamAccountName • $PortalSuperReaderClaim.ToEncodedString() • $wa.Properties["portalsuperreaderaccount"] = $PortalSuperReaderClaim.ToEncodedString() • #Set the web application policies • $SRpolicy = $wa.Policies.Add($PortalSuperReaderClaim.ToEncodedString(), "PortalSuperReader") • $SRpolicy.PolicyRoleBindings.Add($wa.PolicyRoles.GetSpecialRole("FullRead")) • $SUpolicy = $wa.Policies.Add($PortalSuperUserClaim.ToEncodedString(), "PortalSuperUser") • $SUpolicy.PolicyRoleBindings.Add($wa.PolicyRoles.GetSpecialRole("FullControl")) • #Update the web app • $wa.Update() • #IISReset • iisreset Web Application Policy

29. Fun with Claims The value of Claims Based AuthN and AuthZ Reindeers like to eat bananas

30. The Scenario – Profile Claims • Wanted to make the user experience to add mapped claims easy • Re-Use attributes about a user for securing content in SharePoint • Did not want to make adding a new claim a code deployment  Trusted Provider  CCP Search  CCP Resolve  CCP Augmentation

31. 1 Custom Claim Provider 1 Profile Service Recipe – Profile Claims • 1 Profile Database • 1 SharePoint Site

32. Profile Claim Provider It is possible to lead a cow upstairs but not upstairs

33. The Scenario – Temporary Sharing of Files with Federated Users • Share documents with external users regardless of authentication • User May not have a user account in SharePoint • Needed to provide secure access for a defined time period • Self-Managing of user access  Trusted Provider  CCP Search  CCP Resolve  CCP Augmentation

34. Architecture Expired Facebook Sharing Token Claim Google PayPal

35. Recipe - Temporary Sharing of Files with Public Federation • 1 Custom Claim Provider • 1 Custom Claim Generator • 1 Custom Database • 2 SharePoint Sites • 2 Custom Web Parts • 1 Custom Ribbon Extension Best With: • External ad-hoc collaboration with Partners or contractors • Public Federation with Trusted Users

36. Demo TempShare Claim Provider The sentence "The quick brown fox jumps over a lazy dog." uses every letter of the alphabet!

37. Building Custom Claim Providers - Hints • Good for providing search and resolve of identity information • Heads up • All claim providers fire several times • Claims are immutable (cannot change once issued) • Incoming claims are not available at authentication time OOTB * * http://blogs.technet.com/b/speschka/archive/2011/03/29/how-to-get-all-user-claims-at-claims-augmentation-time-in-sharepoint-2010.aspx

38. Building Custom Claim Providers – More Hints • Claims Providers • Encoding, casing • “Welcome email” support • Identity resolution • Responsible / not responsible • Debugging • Deployment • App Roles vs. Web Application vs. Central Admin • Create 2 separate WSP’s, Enable AutoActivateInCentralAdmin

39. In Review: Session Objectives and Takeaways • SharePoint, claims and federation (Recap) • Fun with Claims • Demo – ADFS/AD Claims Provider • Code – Migration from classic to SAML • Demo – Profile Claims Provider • Demo – TempShare Claims Provider • General Tips and Tricks for Claims

40. Related Content • SIA204 | Cloudy Weather: How Secure Is the Cloud? • SIA208 | Demystifying Microsoft Forefront Edge Security Technologies: TMG and UAG • SIA318 | Managing and Extending Active Directory Federation Services • SIA403 | Troubleshooting Federation, ADFS, and More AZR78-HOL | Introduction to Access Control Service SIA01-TLC | Microsoft Identity and Access • Find us later at: • SharePoint TLC Booth • Ask the Experts

41. Links • http://blogs.msdn.com/entdev - Demo code http://blogs.technet.com/b/speschka/ - SharePoint CBA Resources

42. Resources Learning TechNet • Connect. Share. Discuss. • Microsoft Certification & Training Resources http://europe.msteched.com www.microsoft.com/learning • Resources for IT Professionals • Resources for Developers • http://microsoft.com/technet http://microsoft.com/msdn

43. Evaluations Submit your evals online http://europe.msteched.com/sessions

44. © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.