How Claims is Changing the Way We Authenticate and Authorize in SharePoint

1. Antonio Maio
Protiviti, Senior SharePoint Architect & Senior Manager
Microsoft SharePoint Server MVP
How Claims is Changing the Way
We Authenticate and Authorize
in SharePoint
Email: Antonio.maio@protiviti.com
Blog: www.trustsharepoint.com
Slide share: http://www.slideshare.net/AntonioMaio2
Twitter: @AntonioMaio2

2. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
About Protiviti
INDIA (3)
Protiviti (www.protiviti.com) is a global consulting firm that helps companies solve problems in finance,
technology, operations, governance, risk and internal audit. Through our network of more than 70 offices in
over 20 countries, we have served more than 35 percent of FORTUNE® 1000 and Global 500 companies. We
also work with smaller, growing companies, including those looking to go public, as well as with government
agencies.
Protiviti is a wholly owned subsidiary of Robert Half International Inc. (NYSE: RHI). Founded in 1948, Robert
Half International is a member of the S&P 500 index.
• 2,500+
professionals
• 1,000+ clients
• 70+ offices
• Over 20
countries in
the Americas,
Europe and
Asia-Pacific
Protiviti is one of
the fastest
growing
consulting firms
worldwide. Our
revenues have
increased from
US $15 million in
2002, to US
$423.8 million in
2011.

3. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
• Introduction to the Concept of Claims
– Types of Claims Retrieved – How do I know which ones?
• Authentication vs Authorization
– Claims Based Authentication
– Using Claims for Authorization
– Permissions
– People Picker
• Architecture and Trusted Identity Providers
– Enabling Claims Based Authorization with Trusted Identity Providers
– Customizing Claims Authentication Process
– Augmenting Claims with Custom Claim Providers
• Common Customer Needs and Scenarios
Agenda

4. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
• User attributes
• Metadata about a user
• AD attributes/LDAP attributes
What is a Claim?
What’s Missing?

5. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Trust!

6. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
What is a Claim?
Claims are trusted assertions I make about myself
– Identity attributes retrieved from a trusted identity provider
– Digitally signed so that I can verify the identity provider
– Packaged and signed in a standards-based way (ex. SAML)
(SAML = Security Assertion Markup Language)
Allow me to take my identity across network
boundaries in a trusted and secure way!

7. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
• Name Antonio Maio
• Email antonio.maio@protiviti.com
• Company, Department Protiviti, SharePoint Practice
• Security Clearance Secret (Canada)
• Military Rank <none>
• Employment Status FTE
• Over 18 Years Old Yes
• Valid Driver’s License Yes
• Country of Birth Canada
• Citizenship Canadian, Italian
• Residence Dallas, Texas, USA
Consider, why do you trust them?
Claims About Me

8. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Authentication
The process of determining that someone is who they say they are
• Typically done today through username/password
SharePoint 2013 – Claims Based Authentication is the default Auth’n method
• New Web Applications are Claims Enabled
• Classic Mode authentication has been deprecated - Only thru PowerShell
How do Claims all us to go beyond classic authentication?
 Single Sign-On across systems in different domains
 Federate between SharePoint On Premise and O365
 Verify additional info about a user during the authentication process
 Required for new SharePoint 2013 features like Server-server Auth,
App Authentication

9. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Configuring Claims Based Authentication
• Central Admin > Manage Web
Applications > New Web Application
• By default claims enabled
• SSL is required for most scenarios
• Trusted identity providers
• Server to Server Authentication
• App Authentication
• Select your Authentication Protocol
• Windows Auth: NTLM or Kerberos
• Forms Based
• Trusted Identity Provider (SAML)
or some combination…

10. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Configuring Claims Based Authentication
PowerShell
• Ensure you have the correct permissions
(securityadmin and dbowner on DB, part of administrators group on server)
• Sample:
$ap = New-SPAuthenticationProvider
New-SPWebApplication -Name "Contoso Internet Site" -Port 443 -HostHeader sharepoint.contoso.com -
URL "https://www.contoso.com" -ApplicationPool "ContosoAppPool" -ApplicationPoolAccount (Get-
SPManagedAccount "DOMAINjdoe") -AuthenticationProvider $ap -SecureSocketsLayer
New-SPWebApplication -Name <Name> -ApplicationPool <ApplicationPool> -ApplicationPoolAccount
<ApplicationPoolAccount> -URL <URL> -Port <Port> -AuthenticationProvider $ap
Where:
<Name> is the name of the new web application that uses claims-based authentication.
<ApplicationPool> is the name of the application pool.
<ApplicationPoolAccount> is the user account that this application pool will run as.
<URL> is the public URL for this web application.
<Port> is the port on which the web application will be created in IIS.

11. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Types of Claims Retrieved
• Standard Claims
– Only claims retrieved when using
NTLM/Kerberos
– Only claims supported through Office
365/SharePoint Online
• Custom Claims
– Trusted Identity Provider required:
ADFS, Ping Federate, Thinktecture, etc.
Name identifier
Primary SID
Primary Group
SID
UPN
User Logon Name
User ID
Name
Identity
Provider
Name Issuer
Is
Authenticated
Farm ID
Role
Group SID

12. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
How do I know which claims were
retrieved?
• Use the SharePoint Claims Web Part developed by
Steve Peschka
Download and Configuration instructions available here:
http://www.trustsharepoint.com/2013/04/how-do-i-know-which-claims-were.html

13. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Authorization
Determining what resources users are permitted to access and
what actions they’re permitted to perform
• Typically through permissions in SharePoint
• How do claims allow us to go beyond simple Permissions?
 Be specific to the user
 Be done without knowing who the user is
 Be dynamic – ex. changes in a user’s security clearance are reflected
 Include environmental attributes (current time, GEO location, connection
type, etc.)
 Be an alternative to security groups – Groups do not scale
 Example: user must be part of GroupA and GroupB and GroupC to access a
resources

14. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Simple Permission Examples
Users and Groups
• Finance AD Group has Full Control on Library A
• ProjectXContractor SP Group has Read access on site B
• Antonio.Maio AD user has Contribute access on Document C
Principle
(user or group)
Permission Level
(collection of permissions)
Information Object
(item or container)

15. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Permission Examples: Claims
• Remember: Claims are trusted attributes about a user
• May assign a Claim as part of a permission to an object or
container (just like a user or group)
• ‘SecurityClearance=Secret’ has Full Control access on Document X
• ‘ITARCleared=True’ has Read access on Library Y
• ‘EmploymentStatus=FTE’ has Contribute access on Site Z
Principle
(a claim in this case)
Permission Level
(collection of permissions)
Information Object
(item or container)

16. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
People Picker
1. Type the value of the claim in the Find
field (Top Secret in our example)
Note: people picker cannot resolve values. Typos will
appear here as if they are valid values. It will display
multiple valid selections for your value, one for each
claim type available.
2. Next, you select the attribute type in
the All Search Results list on the left
side – in our case we select Clearance.
3. The list on the right side will then
reduce the view to one selection for
the attribute type selected. Select that
attribute type in the right list now.
4. Click the Add button, and then click OK

17. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
People Picker and Assigning Permission
• Once the claim is selected it
can be assigned as a
permission with a permission
level to some securable
object

18. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Enabling Claims Based Authorization
 Planning Required
 Driven by a need to secure information at more granular level
 Standard Claims Typically are Not Sufficient
 Determining policies, claims, getting stakeholders to agree, etc.
 Which trusted identity provider? Which attribute store?
 Infrastructure Required
 Storing, managing, retrieving, transforming, trusting claims
 Configuration Required
 Deploying Identity Provider, Connecting it to SharePoint, Configuring
Trust, Sign-in, Claims Rules

19. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Enabling Claims Based Authorization
 High Level Steps
1. Create the SharePoint 2013 Web Application
2. Install and Configure an STS Server (Secure Token Server)
• Ex. Deploy ADFS, Domain Joined Server (possibly a farm)
3. Configure STS with the SharePoint web application as a Relying Party
• Configuration within ADFS
4. Configure SharePoint 2013 to trust STS as an Identity Provider
• Import ADFS Token Signing Certificate into IIS on SharePoint
• Use PowerShell to configure ADFS as Trusted Provider
5. Configure SharePoint Web Application to use Claims Based
Authentication and STS as the Trusted Identity Provider
• Within Central Admin

20. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Relying
Party (RP)
Trusted Identity Provider (IP)
SharePoint
2013
Client System
Ex. web browser
Secure Token Server (STS)
EX. Active Directory
Federation Services
(ADFS)
Identity Store,
Attribute Store,
(AD, Database or
Directory)
3. Authenticate User,
Get info (claims)
about user
Token with
Claims
Format:
SAML/WS-Fed
4. Authenticated user,
attributes retrieved &
STS creates token
1. Sign In Page
5. User is authenticated
and SharePoint 2010
now has user’s claims &
knows it can trust them
Claims Based Auth’n/Auth’r Architecture
2. Requests authentication
(thru username/password)
and a token
Browser Redirect

21. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Relying
Party (RP)
Trusted Identity Provider (IP)
SharePoint
2013
Client System
Ex. web browser
Secure Token Server (STS)
EX. Active Directory
Federation Services
(ADFS)
Identity Store,
Attribute Store,
(AD, Database or
Directory)
3. Authenticate User,
Get info (claims)
about user
Token with
Claims
Format:
SAML/WS-Fed
4. Authenticated user,
attributes retrieved &
STS creates token
1. Sign In Page
5. User is authenticated
and SharePoint 2010
now has user’s claims &
knows it can trust them
Customizing Claims Authentication Process
2. Requests authentication
(thru username/password)
and a token
Browser Redirect
Custom Claim Provider
Custom Claim Provider
…
Claim Rule
Claim Rule
…
SQL DB,
LDAP, PKI
etc…
iAttributeStore …

22. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
• Select a Standards-based Identity Provider (SAML)
– Active Directory Federation Services 2.0 or later
• Supports full SAML 1.1 and 2.0 Tokens and Protocol
• Supports WS-Federation Tokens and Protocol
• SharePoint 2010/2013 use SAML 1.1 tokens and SAML 2.0 protocol
• Must authenticate against Active Directory
– Ping Federate (Commercial)
– Thinktecture (Open Source)
Trusted Identity Providers
Trusted Identity Provider (IP)
Secure Token Server (STS)
EX. Active Directory
Federation Services
(ADFS)
Identity Store,
Attribute Store,
(AD, Database or
Directory)
3. Authenticate User,
Get info (claims)
about user
Token with
Claims
Format:
SAML/WS-Fed
4. Authenticated user,
attributes retrieved &
STS creates token

23. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Augmenting Claims - Custom Claim Providers
• Used to Augment User Claims and Customize People Picker
• SharePoint farm level feature
• Can deploy more than one
• Called after user is authenticated
…and after Trusted Identity Provider has already returned claims
– Built on top of WIF (Windows Identity Framework)
– Used to augment claims or transform claims
– Used to customize the People Picker (ex. resolving claims through user search)

24. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Custom Claim Provider Deployment
• Deployed as a Farm Level Feature Receiver – requires more code
– Must inherit from SPClaimProviderFeatureReceiver (lots of examples)
• Can deploy multiple claim providers
– Called in order of deployment
• Once deployed - Available in every web app, in very zone
– Can cause performance issues
– When user logs in, all Custom Claim Providers deployed get called
• Set IsUsedByDefault property in Feature Receiver Def'n to False
• Turn it on manually for required web apps

25. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Common Customer Needs
• How do I secure access to sensitive information just to certain
people and only under certain conditions?
– (More) Fine Grained Access Control
– Sensitive content sitting beside non-sensitive content
• I have compliance requirements about who can access certain
types of data and when
– How do I enforce that without stopping business?

26. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
What Types of Claims are Useful?
• Military, Intelligence, Government Defense
– Security Clearance, Caveats, Communities of Interest
– Need to Know
• Commercial
– Department, Team or Role
– Current Date/Time, Current Device (BYOD)
– Group Membership with multiple groups
– Partner ID or Business ID (in partner extranet scenarios)
• Aerospace/Defense Contracting
– Nationality + Current Location
• Homeland Security
– Agency (law enforcement, emergency response, public health…)
– Scope or Level (local, state, federal), Current Threat Level

27. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Intelligence Military Examples
Classification
Caveats
Need to Know
Security Clearance
Caveats
Groups
Has All
Has All
Has Minimum
Classification
Topics
Restrictions
Communities
Security Clearance
Topics
Restrictions
Communities
Has Minimum
Has Any
Not Have Any
Has All

28. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Commercial Example
• Claim: Employee Status
• Document Metadata: Classification (HBI, MBI, LBI)
If employee.status = FTE and document.classification = HBI
Then permit access to document
If employee.status = Contract and document.classification = HBI
Then deny access to document

29. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Government Example
• Claim: Client Case Numbers
• Document Metadata: Document Case Number
If document.case=X AND client.casenumbers includes X
Then permit access to document
If document.case=X AND client.casenumbers DOES NOT includes X
Then deny access to document

30. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
Summary
• Claims Based Authentication/Authorization still a new topic for many
people
– Allows us to take our identities across network boundaries in a trusted and
secure
– Enabling our move to the cloud – required for Identity Federation
• Claims Based Authentication is Default in SharePoint 2013
– Classic Mode is Deprecated (Still there in 2013 but will likely go away next
version)
• Claims are great tool for Enterprise-Grade Authentication and
Authorization
– Infrastructure and Planning Required to take advantage of it
– Leading SharePoint deployments in businesses, government and military to
more fine grained authorization

31. © 2014 Protiviti Consulting Private Ltd. An Equal Opportunity Employer.
• 7th Annual Conference
• 6 SharePoint MVPs presenting
• Full-Day Training Workshops pre and post conference
• Separate tracks for Business Users, Technical Users & UX Professionals
• Government, Association, Nonprofit & Group Discounts Available
Get 15% off! Use: PRO15 when registering
Learn More & Register at SharePointConference.org
Dallas, TX
October 20, 2014

32. Antonio Maio
Protiviti, Senior SharePoint Architect & Senior Manager
Microsoft SharePoint Server MVP
Thank You!
Email: Antonio.maio@protiviti.com
Blog: www.trustsharepoint.com
Slide share: http://www.slideshare.net/AntonioMaio2
Twitter: @AntonioMaio2