Extending Azure ACS Claims for MVC Sessions

Question

I am developing an MVC 4 Application to be hosted in Azure and want to use their ACS service for authentication. Once the user is authenticated I will use the resulting claim details to correlate to my local records. Subsequent to that, I would like to extend the claimset to include additional claims that represent local authorizations which my application would use for authorization decisions. I assume I need to replace the Principle but I'm not sure where/when to do this in MVC and want to avoid breaking any of the authentication plumbing which would normally be used throughout the life of the session. Can anyone shed some light on this?

Answer 1

In addition to what @Eugenio Pace has said, it's worth noting that you can just add and remove claims to and from the IClaimsPrincipal:

public static void UpdateClaims(IClaimsIdentity identity)
{
    identity.Claims.Remove(identity.Claims.SingleOrDefault(x => x.ClaimType == ClaimTypes.Name));
    identity.Claims.Remove(identity.Claims.SingleOrDefault(x => x.ClaimType == ClaimTypes.Email));
    identity.Claims.Add(new Claim(ClaimTypes.Name, "Steve Smith"));
    identity.Claims.Add(new Claim(ClaimTypes.Email, "steve@smith.com"));
}

UpdateClaims(User.Identity as IClaimsIdentity);

Claims added can either be one of the types enumerated in ClaimTypes, or a custom string of your own devising. You can add multiple claims of type ClaimTypes.Role - I'm not sure about the other types.

From the ClaimsCollection docs:

Represents a collection of claims associated with a single subject.

Adding a Claim to a ClaimCollection implicitly associates that Claim with the subject associated with the collection by calling the SetSubject method.

Removing a Claim from a ClaimCollection implicitly removes this association by also calling the SetSubject method.

http://msdn.microsoft.com/en-us/library/microsoft.identitymodel.claims.claimcollection.aspx

Update

For .Net 4.5, the identity class and the method for updating claims have changed, as well as the namespace:

using System.IdentityModel;
using System.Security.Claims;

public static void UpdateClaims(Member member, ClaimsIdentity identity)
{
    identity.RemoveClaim(identity.Claims.SingleOrDefault(x => x.Type == ClaimTypes.Name));
    identity.RemoveClaim(identity.Claims.SingleOrDefault(x => x.Type == ClaimTypes.Email));
    identity.AddClaim(new Claim(ClaimTypes.Name, "Steve Smith"));
    identity.AddClaim(new Claim(ClaimTypes.Email, "steve@smith.com"));
}

UpdateClaims(User.Identity as ClaimsIdentity);

http://msdn.microsoft.com/en-us/library/system.security.claims.claimsidentity.aspx

Answer 2

The extensibility point in WIF for enriching the claimset is the ClaimsAuthenticationManager

From the docs:

The claims authentication manager provides an extensibility point in the RP processing pipeline that you can use to filter, modify, or inject new claims into the set of claims presented by an IClaimsPrincipal before the RP application is called.

You can also add rules in ACS to enrich the token with the claims you need.