Claims-Based Authentication and User Provisioning

Question

Been mulling something over with regards to CBA in 2010.

Suppose that I have a trusted IdP. A user authenticates against the IdP and enters my SharePoint site for the first time.

Unless the user has already been given a role assignment, the user won't have access to the site. Seems like a Catch-22 (or am I wrong?). Q1. Would it be possible to provision the SPUser and the role assignments without building a custom MembershipProvider? I am assuming this is a "No" and that a custom MembershipProvider and access to query the IdP's membership store is required. More generally, how does a CBA user get access to the site in the first place?

Now suppose my IdP also provides a series of claims regarding the user. For example:

• Email
• Display Name
• Country
• Project
• Role

And based on the claims, I would like to use custom code to automatically build the role assignments when the user first logs into the SharePoint site. For example, a user with claims {Country=US,Project=PROJ1,Role=Manager} would be provisioned to a sub-site for "PROJ1" in the group "US Managers".

From what I understand, the correct way to do this would be to implement a custom Microsoft.IdentityModel.Claims.ClaimsAuthorizationManager and inserting that into the request pipeline to provision the role assignments automatically in custom code from the claims. The CAM would execute before SharePoint in the request pipeline and thus it would have a chance to provision the user to the site.

Q2. Is this the best way? Or is there a simpler solution/alternate extension point?

Answer 1

How does a CBA user get access? In claims mode, the ACL does not necessarily store user ids as you see in NT/FBA scenarios. It stores the provider, claim type and value. Then, any user with a claim from that provider that has a matching value for the claim type will be granted access. The claim information is entered via the people picker, or what I call the "Claims Expression Editor" (TM).

I demo this concept as part of the claims talk on Channel 9: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/OSP308 (about 40 minutes in).

In your example, in sub-site "PROJ1", you would search for "US Managers". Then, expand the IdP on the left, select the "Role" node, then click on the entry in body of the control. Then click Add.

You do not need to write custom code to do this.