Azure Authentication

Question

Currently have an ASP.NET Web Application that I plan to convert to Azure. One Application per customer with one SQL DataBase and Membership Services for authentication and authorization. Have a role for user admin and a page where the customer can administer their own userIDs and passwords.

In the upgrade to Azure I plan to offer both a web client and a WPF client. The WPF client will connect to web service over WCF.

What is an appropriate security model?

Not sure if ACS is the right tool. The application must directly provide userID and password authentication with roles and manage that data. A customer admin role must be able to reset a password so an external identity provider does not fit. At the ASP.NET level membership services is doing exactly what I need. I want to extent that model to a WPF client over WCF.

Client is very very chatty. Have a WPF client version today that connect directly to SQL for a limited number of "trusted" high volume customers. Need to get out of that model and into a high volume service model.

Struggling with how to have a common authentication and authorization across ASP.NET and WPF/WCF. I think channel level authentication for WPF to WCF is the right way to go so I am not authenticating every method call.

It looks like WCF Authentication Service is a tool to do what I am looking for. I am not finding concrete example of doing that in Azure. I suspect that feature is in Azure there but maybe slight different terms. Deploy Wish this said - and it deploys on Azure.

Before I get a what have you tried you can get a trial for free. Need permission to evaluate a new technology. What I am probably going to do is open Azure trial at home.

What I am going to try is Azure Membership using TableStorage as a provided. Then use WCF Web Services with WS and userName credentials. Will report back.

Answer 1

About WPF, you just have one choice to use Web Interface as WPF is not supported in Azure. See here for more on this regard.

You web application will be exactly ASP.NET (MVC if you decide to choose) so any security model you will choose will work on Windows Azure. Windows Azure does not dictate or force any one to choose ASP.NET security mode. As an application developer you make this decision.

ACS is just a service, provides access and authentication services to applications using it, so it does not have builtin provider and even if it is, how it will be different then any OpenID based authentication service?

You sure can use membership providers or built you own depend on your choice.

Depend on what kind of Certificate you are talking here, there are several places where certificates are needed for various reasons. In some places it is not an "option" is is a "necessity" so unless there is specific description about what kind of certificate you mean, there is nothing can be shared.

About last line in your question, you sure can secure WCF based communication using PKI or credential based methods however as I told earlier WPF is not supported on Azure so may be out of context. Yes, you sure can use membership provider to secure communication between WCF and ASP.NET application.

Finally I am not sure if I understood your design as described in line 1. Also you asked a lot in one question :)