ADFS in ASP.NET usage

Question

I am relatively new to uisng ADFS (in ASP.NET) which is what my company wants to use and just have a few basic questions about that:

1. Am I correct there is no explicit "Authorize" call you can do like with ASP.NET Membership Providers? Unless you on a domain it presents you with a login screen and once you enter credentials it does validation and returns back a token with claims information.

2. Can you configure some forms to allow anonymous access like you can do with Forms Authentication?

Thanks.

Answer 1

Yes, you can setup pages in your app that don't require authentication. It works exactly like you'd do with Forms Auth.

On #1: in a claims based model, your app relies on an external system to authenticate users and receives evidence that the user is valid in the form of a token. You can completely automate this (using WIF and config files), or you can explicitly trigger the authentication process. In any case, your app won't be responsible for validating legitimate users anymore. It is a responsibility that it delegates to the STS (e.g. ADFS). That's why apps are called "relying parties".

I'd suggest you read the first couple chapters of the A Guide to Claims based Identity for a better understanding of the underlying principles.