Customer Reviews

Programming Windows Identity Foundation (Dev - Pro)

5 star:		(10)
4 star:		(1)
3 star:		(1)
2 star:		(1)
1 star:		(0)

 

 

This is a must have for any anyone tasked with writing claims aware applicatons. Do NOT let the size of this book fool you either - it is jammed full of critical details. This is the only publication available that goes into the detail that Vittorio goes into. Whether you're new to claims-based development and just want to know enough to get started writing Relying Party's (that's about the first 50 pages), or need the in-depth knowledge of how protocols work, intricate details of WSFAM and SAM, and such, this book has you covered. I also like how Vittorio draws attention to solutions to some common problems, such as home-realm discovery, pass through claims, impersonation, proof-of-possession, custom STS's, and more. You will also find references to some very useful tools to aid in your development.

Having followed Vittorio's work (blog, webcasts, code samples)related to claims-based identity over the last two-three years, I ordered this book as soon as it arrived. And this book did not disappoint. I read the book cover-to-cover within a week of its arrival and found it to be very useful in helping me better understand the concepts behind WIF.

Here are some additional details that I hope will be helpful to anyone considering this book:

1) Claims based identity is an important enabling technology that .NET developers and designer need to understand well. And this is not just case, if you are an ASP.NET or WCF developer. Claims-based identity is important even if you are SharePoint, BI or Azure developer.

2) This book is broken up into two parts. The first part explains the basics of claims based identity. Second part is more advanced and gets into the nuts and bolts of WIF.

3) Don't skip over the ASP.NET chapters (2, 3 & 4 ) just because you are not going to use WIF inside ASP.NET. These aforementioned chapters cover a number of important concepts ( such as single-sign-on, claims transformation, federation) that you will need to understand when using WIF outside of ASP.NET (say with WCF).

4) Being involved with the WIF team for a long time, Vittorio is able to provide important context around how some of the features have evolved, design decisions etc.

5) Last but not the least, it is hard to write a book on security. Fortunately, Vittorio has managed to write it in a conversational, unassuming style that makes it easy to read. Wherever needed, he provides a just in time, overview of protocols ( WS-Trust, WS-Federation and so on) without getting mired in the details associated with these, rather arcane, specifications.

Because there really aren't any good alternatives out there.

As far as technical books go, this one is only so-so. The chapters are somewhat oddly organized -- or one could say disorganized -- and make it difficult to mentally compartmentalize the lessons.

Some of the examples use odd choices of scenarios and it could use more code samples and discussions of the internals and less of the high level concepts (perhaps it's the organization that's throwing me off).

In the end, it's a middling book that becomes a near must-have because of the current lack of in-depth coverage on the topic. I would recommend it, but it's not the most practical of books when it comes to gaining a deep technical understanding of the topic at hand.

If you're looking for a semi-exhaustive explanation of plumbing and details, this might be the book for you. Maybe.

I was looking for some code samples and reasonable quick-start type guides to at least get a proof of concept up and running, but there is no sort of cohesion to the book that makes it possible. The first part labors on about federated identity and fundamentals, which is fine to an extent. However, it just keeps going on with theory... again, which is fine if you want to sit and read a book to learn about federated security.

A preferred approach, and the one followed by most good technical books, is to start with a basic example and explain the theory behind it in small chunks.

I was surprised by how frustrating this book is based on the other reviews, so maybe I'm missing something everyone else is getting. But, if you're looking for a reasonable quick start to WIF with meat to back up the code, this probably isn't a good fit for you.

This is a very good book, the author knows extremely well what he explains, provides a great introduction and the example of using the driver's license or passport as a valid identification from a trusted issuer provider on a movie theather or liquor store is an excellent analogy to understand. He goes quickly about how to use it on your own app, how to get claims backs and create custom code to extend the framework. Also he gives a lot of deep theory about the authentication process and all the complexities of security and how WIF makes things easier for you. He mentions how to create a test STS using WIF (new Visual Studio template that comes with the framework), that can be used during development to simulate a real life scenario and how to create your own custom claims.

I read the book, I have a better understanding, 200+ pages of great wisdom. Get it!!

Thanks

Even though I was familiar with the federation technology, I appreciated the hold-your-hand intro to it, esp. in the MS context. A lot of folks will benefit from it, while some can just skim/skip portions. This book is great for architects who may not write much code (if any) but who need to understand the WIF thoroughly since it is such an important piece of the MS stack. Clearly this is a book for initial immersion in WIF (and a very good one for it), not for continued use as a reference.

I look forward to future output from the author.

Writing books can be a huge time suck. Writing books can be a maddening and often times unrewarding exercise that starts with the desire to get your message and knowledge out to your target audience in a consumable manner that conveys knowledge in your own voice.
Enter editors - who tend to ramp you back and change your voice, your style, and your personality into something that barely resembles you. And, the message and style often gets lost in the process.
However, now and then, the author has such a strong style and a strong will that even the editors can't ratchet back the message and style. One such book is the fantastic book "Programming Windows Identity Foundation" by Vittorio Bertocci.

The Windows Identity Foundation (or, WIF) is a claims-based identity model for the .Net Framework. By being based on the .Net Framework, this means that any modern Windows Server and application can participate in strong identity authentication and authorization using common and very secure methods to determine the user, what the user has access to, and what the application can do with data.
Bertocci is a Senior Architect Evangelist on the extended Windows Identity team. His primary job is to interact and work with customers to see that their needs are met using the Windows platform. His experience in Identity, cloud computing and the Azure platform put him in a unique position to provide deep and concise guidance on how to use WIF to solve identity needs in customer applications and servers.
The book looks at the basis of Windows Identity using WIF. His explanations are clear, concise and understandable to even the most novice to identify and claims-based technologies. Which, is a good thing, because - this is not simple stuff. But, Vittorio explains in such a way that the reader is instantly familiar with what the problems with identity across disparate systems and applications are, and how WIF can solve these problems. He walks the reader through how claims-based identity works, and then applies it immediately to real-world solutions in .Net and ASP.Net.

And, this is only the opening section. Vittorio then takes the reader into deeper territory. Make no mistake - the reader has enough to go on in the first section. With some forethought and use of the guidance that he provides, you can already add value to your current applications. But, basics are rarely enough to manage the hard problems. Vittorio dives deeper into WIF to provide information on using ASP.Net and WIF to solve bigger problems in identity. He takes the reader into advanced ASP.Net development for identity and then looks at how WIF and the Windows Communications Framework (WCF) can tackle bigger problems.
The shift to cloud computing is a paradigm that is of current concern to most application developers. And, identity is a key issue. How can I manage who access my cloud and how do I authorize against the disparate application on premise and in the cloud? The answers are well-covered in his treatments on the Windows Azure platform and WIF.
Finally, Vittorio gives a glimpse of what is to come and the challenges that the developer will face. There is no question that the problems will be more complex and that the solutions will require a great deal of imagination and innovation. It's clear that Vittorio has a handle on these issues and that his vision of what Microsoft will be doing in server and in platform tools, interfaces and techniques is not only mature - but available today.

The most amazing thing is that most computer books on technologies this complex weigh in at 500+ pages. Vittorio manages to convey the very complex topics into a completely applicable guide in less than 250 pages.
Frankly, you will be hard-pressed to find a more complete and technically consumable treatment of WIF and the problems faced by applications and platforms needing identity functions. If you look for one book to cover the majority of identity and claims-based processes - this is the book.

Vittorio produced a great book. I have a difficult time with his Microsoft presentations due to the accent but he really knows his stuff. It explains in detail how to perform S.S.O. for the following scenarios:

1. Browser clients (WS-Federation)
2. WCF clients (WS-Trust)

The only think lacking in this book is demonstrating W.I.F. interop with Java clients. This would have been helpful.

Another excellent source for W.I.F. education is Dominick Baier (Microsoft MVP with focus on security). He has a great blog with lots good W.I.F. tutorials.

I just started looking into WIF and this was a great book. I read the book cover to cover and never once did I feel like I was in over my head. Vitorrio does a great job at explaining the content in an intuitive fasion. He explains everything from the idea behind claims based identity to creating custom STSes. I would definately recommend reading this book before jumping into WIF because it will definitely provide the context needed to understand how the whole system works

If you've used Windows Identity Foundation at all, you'll find that the documentation on it is lacking. There are a ton of entry-level "getting started" articles combined with even more "high-level theory" articles out there, but really not much in the way of concrete information.

This is the Lost Windows Identity Foundation Documentation.

It's great from a reference and from a how-to standpoint, including plenty of diagrams and code snippets that help to explain how different scenarios work and how those scenarios specifically apply to WIF.

I was working on a custom passive STS using WIF and found it nearly impossible to do without this book. Once I had it, there was more in it than I was even hoping for - explanations of how to handle sliding token expiration, for example, which is pretty much nowhere to be found out on the web.

It's also been really handy in helping to explain complex federation issues to my team, who are not nearly as neck-deep in this stuff as I am. After we got the first copy of this, we actually ended up getting a second because it's so useful and people sort of "hog it" and forget to return it to the library.

The only thing that's missing in my opinion is how to work with WIF in an ASP.NET MVC environment. WIF was written primarily with web forms in mind, so all of the code samples and scenarios described in this book revolve around web forms. It's sort of an unmentioned "exercise for the reader" to get things working with MVC. That's more a fault with WIF than the book, though, hence I am not docking a star for missing it.

If you use WIF, you owe it to yourself to pick up a copy of this book.