How to authenticate WCF using ACS integration with a Windows Live ID?

Question

I have a WCF service that uses UserName authentication through ACS. This works fine when I use service identifiers, but when I try to use my Windows Live ID credentials, I get the following error:

System.ServiceModel.FaultException: ACS10002: An error occurred while processing the SOAP body. ACS50012: Authentication failed. ACS50026: A director named " [e-mail] " is not a known director.

Unfortunately, I have not yet found an example of how to use the Windows Live ID using the WCF service. The only examples I could find seem to focus on integrating multiple identity providers with ASP.NET or MVC websites.

Any help in this regard would be greatly appreciated ....

Answer 1

ACS will not authenticate your Live ID username and password directly. ACS acts as a federation provider for Live ID, it is intermediate, so it will consume tokens issued by Windows Live ID. ACS supports Live ID authentication out of the box in passive scenarios (browser redirection), but for the WCF service, you can use the Live Connect API instead.

To use LiveID with your service, your client first authenticates with LiveID and then submits the token issued by LiveID to your WCF service. Hook yourself, although there are some hoops to jump over to fix it all.

To use the Live Connect API, you must register your WCF service as an application with a Live ID. Customers who consume your WCF service will then need to be able to process the login web page and user consent pages that will request a Live ID. The documents below are a good start.

http://msdn.microsoft.com/en-us/library/hh243641.aspx

http://msdn.microsoft.com/en-us/library/hh243647.aspx

http://msdn.microsoft.com/en-us/library/windows/apps/hh465098.aspx

The next problem is that the token you get from Live Connect will be in JWT (JSON Web Token) format. I'm not sure if you can request a different token format from a live connection, but if your WCF service authentication is based on WIF, most likely a SAML token is expected. JWT is a fairly new token format that WIF does not yet support, so you need to configure WIF SecurityTokenHandler for your service, which understands JWT tokens. The third link above has some code for reading JWT, which starts at least.

Answer 2

I came across this article that uses identity delegation for the above use case: http://social.technet.microsoft.com/wiki/contents/articles/7286.asp-net-relying-party-to-wcf-soap-relying -party-delegation-with-windows-live-id.aspx Will there be a message if I succeed or not. Enjoy it!