Call SharePoint WCF web service protected by claims based authentication

Question

I'm using SharePoint 2010 as a document store for a front-end .NET application. The SharePoint farm is using Claims Based Authentication. I want to call a WCF web service on the farm with a particular user's credentials.

We were doing this using Windows authentication, whereby the user logged in to the .NET app which authenticated against Active Directory, and we made the WCF calls using that identity. However now the .NET app is using WIF I don't know how to send the user's claims with the WCF call.

Here's the code we're using for the WCF call with Windows Auth:

SortedList groups = new SortedList(); 
SharepointUserGroupsWCF.UserGroupSoapClient client = new SharepointUserGroupsWCF.UserGroupSoapClient(); 
client.ClientCredentials.Windows.ClientCredential = (NetworkCredential)credentials; 
client.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation; 
client.Endpoint.Address = new EndpointAddress(webPath + "/_vti_bin/usergroup.asmx"); 

XElement groupXml; 
groupXml = client.GetGroupCollectionFromSite(); 

XmlDocument doc = new XmlDocument(); 
doc.LoadXml(groupXml.ToString()); 
XmlNamespaceManager nsmgr = new XmlNamespaceManager(doc.NameTable); 
nsmgr.AddNamespace("sp", "http://schemas.microsoft.com/sharepoint/soap/directory/"); 
foreach (XmlNode group in doc.SelectNodes("//sp:Groups/sp:Group", nsmgr)) 
{ 
    groups.Add(group.Attributes["Name"].Value.ToUpper(), ""); 
} 

Where:
- webPath = https://sp.test.com/
- credentials = new NetworkCredential("MyUsername", "MyPassword", "MyDomain");

What I need help with is how to convert this to send claims instead of Windows credentials.

Answer 1

I suggest you review the Windows Identity Framework SDK for calling a web service using active authentication.

Your code needs to contact a configured identity provider, get the token, and present that token to SharePoint.

The patterns and practices group has publishing "A Guide to Claims based Identity and Access" and this guide has a section about web services. Look for the section titled "Implementing the Active Client"

http://msdn.microsoft.com/en-us/library/hh446528.aspx

Answer 2

You don't need to pass along a claims token, it will handle this for you. Even when you open up a claims based site, you still get a normale AD based login prompt and you can pass AD credentials to the webservices just as well.

If you really need the token, I think you'll have to call the SharePoint token service (STS) yourself to create one. But I use the webservices of claims based sites with AD credentials without any problem. The only thing which can be a problem is the login page, especially custom ones. But that's easily handled by extending your site to a new webapplication (different URL) which has only Windows authentication enabled.

Answer 3

If your claims provider integrates with Active Directory then you can extend your web application by adding an Windows Auth / NTLM zone and make web service calls through that internal zone. Your .NET client application code doesn't need to change at all in this case. It is a common practice to extend claims-based web application by adding a Windows Auth zone for maintenance purposes - you must have a Windows Auth zone configured in order for search to be able to crawl SharePoint content. One thing to keep in mind when you assign permissions to claims users (going through the trusted claims provider) and windows users (going through the Windows Auth zone) is that they will appear as two completely different users to SharePoint, even though they map to exact same user in AD.

Answer 4

I don't know how to answer you question specifically. However, could you consider extending the SharePoint application (that hosts your documents) and configuring Basic authentication over SSL (for the extended app)? Connect to the web service via the extended App. Howard (ex Orwell).