IIdentity and IPrincipal
ASP.NET and Windows Communication Foundation (WCF) developers ordinarily use the IIdentity and IPrincipal interfaces to work with the user’s identity information. WIF extends these interfaces, as illustrated in the following diagram:
Developers can access the user’s name just as always. They can also access other claims made for the user, such as e-mail address, age, mailing address, and so on.
WIF provides this functionality through existing
methods such as
Thread.CurrentPrincipal. You call
Thread.CurrentPrincipal and cast the returned
IPrincipal to an IClaimsPrincipal. As the previous diagram
illustrates, IClaimsPrincipal exposes a collection of
identities, each of which has a collection of claims made about the
subject, which is typically the current user.
A claim is represented by Claim class. This class has the following important properties:
- ClaimType represents the type of claim and is
typically a URI. For example, the e-mail address claim is
- Value contains the value of the claim and is
represented as a string. For example, the e-mail address can be
represented as “email@example.com”.
- ValueType represents the type of the claim
value and is typically a URI. For example, the string type is
- The value type must be a QName according to
the XML schema. The value should be of the format
namespace#formatto enable WIF to output a valid QName value.
- If the namespace is not a well-defined
namespace, the generated XML probably cannot be schema validated,
because there will not be a published XSD file for that
- The default value type is
- Please see http://www.w3.org/2001/XMLSchema for well-known value
types that you can use safely.
- Issuer is the identifier of the security token service
(STS) that issued the claim. This can be represented as URL of the
STS or a name that represents the STS, such as
https://sts1.contoso.com/sts. For more information, see IssuerNameRegistry.
- OriginalIssuer is the identifier of the STS
that originally issued the claim, regardless of how many STSs are
in the chain. This is represented just like Issuer.
- Subject is the subject whose identity is being
examiner. It contains a IClaimsIdentity.
- Properties is a dictionary that lets the
developer provide application-specific data to be transferred on
the wire together with the other properties, and can be used for