System.Web.Security.SingleSignOn Namespace

Represents a service that defines identities and attributes for controlling user access to Web site resources, such as Active Directory Domain Services.

An Active Directory account store.

Configures an ActiveDirectoryAccountStore so that the Federation Server generates group claims at run-time for authenticated users. Claims configurations are based on specified attributes, such as the common name (CN) attribute, e-mail addresses, UPNs, group SIDs or custom attributes, such as titles.

Directs tracing or debugging output to a Writer.

A managed wrapper for the native CERT_CONTEXT structure. For more information about the CERT_CONTEXT structure, see "CERT_CONTEXT" in security section of the MSDN library.

Configured signing certificates should contain private keys that are used to sign data. This exception is thrown if the certificate configured as a signing certificate does not have its private key.

This API supports the product infrastructure and is not intended to be used directly from your code. The CertInfo object supports the AD FS infrastructure and is not intended to be used directly from your code. Used by the X509VerificationMethod to identify a particular certificate in the FederationCertificates certificate store of the TrustPolicy.

Creates different types of claim, claim generation, and claim transformation objects.

The exception that is thrown if the Federation Service encountered an exception during claims mapping.

A transform to use for common name (CN) claims.

A collection of universal unique identifiers (UUIDs) for corporate claims.

Contains the detailed results of credentials verification. Details include information about the Account Store that verified or failed to verify the credentials, resulting success or failure codes, and other information that could be useful for a detailed audit.

A collection of CustomClaim objects.

A collection of CustomClaimLdapAttribute objects.

A collection of CustomClaimTransform objects.

The transform to use for the CustomModule. Provides a reference to a user provided extensibility class which implements the IClaimTransform interface.

AD FS token verification certificates in the Federation Service Certificate Store.

This class supports the AD FS infrastructure and is not intended to be used directly from your code. Invoked by ASP.NET to load configuration changes made to the web.config.

This API supports the product infrastructure and is not intended to be used directly from your code. This class supports the AD FS infrastructure and is not meant to be used directly from your code. The AD FS Web Agent and the Federation Service Proxy use this class to communicate with the Federation Server.

A group claim for the trusting or trusted realm.

A transform for a GroupClaim object.

Specifies how to populate a GroupClaim based on the value of an LDAP user attribute, when added to a GroupLdapAttributeCollection as part of an LdapClaimGeneration object for an AccountStore. At authentication time, the LDAP attribute specified in the GroupAttribute property will be queried, and if any of its values match the value specified in GroupAttributeValue it will cause the group claim, identified by CorporateGroupUuid, to be added to the user claims. If using an active scripting language like VBScript, the recommended method for constructing a GroupLdapAttribute object is CreateGroupLdapAttribute.

Transforms a GroupClaim to a UpnClaim.

Defines a way for the Federation Service to digitally sign an AD FS token for an application (represented in the trust policy by a TrustingApplication object). Such tokens are signed using symmetric keys which are securely shared using the Kerberos security protocol of a Windows forest. A KerberosSigningMethod defined for a particular application overrides the global default X509SigningMethod defined in a Federation Service’s web.config file. Because the KerberosSigningMethod utilizes a cached symmetric session key, it may provide performance benefits over the default asymmetric-key-based signing method.

Defines a way of populating claims for an LDAP-based account store (represented by an LdapDirectoryAccountStore object in the trust policy). Attributes on user objects can be mapped into email, UPN, common name, group, or custom claims. The UPNAttribute property must be null when the LdapClaimGeneration applies to Active Directory.

Reads configuration data for the Logon Server component of AD FS, which runs on the Federation Service and Federation Service Proxy and is responsible for handling protocol requests to the endpoint URL.

Allows web forms (like clientlogon.aspx) to interact with the Federation Service or Federation Service Proxy on which they are running.

Provides the information needed for a Web form to collect credentials.

Enables the logon server to communicate to ASP.NET Web forms that it invokes. This object may be cast to a more specific context type based on the value in the CurrentAction property.

This class supports the AD FS infrastructure and is not intended to be used directly from your code. The MetabaseHelper class exposes configuration functionality through COM to the AD FS Web Agent for Windows NT Token management UI.

Configured as part of a TrustingRealmClaimTransformation object to specify how to transform email or UPN suffixes for consumption by a resource partner.

The exception that is thrown when no acceptable credential is provided.

This class supports the AD FS infrastructure and is not intended to be used directly from your code. A ProxyInformation object is retrieved by a Federation Service proxy by calling GetFsTrustInformation, and contains configuration information necessary for the proxy to function.

This class supports the AD FS infrastructure and is not intended to be used directly from your code. Its derived classes are part of the Federation Service’s trust policy configuration. However, user code should not derive from this class.

The SingleSignOnMembershipProvider class is intended for use by the Windows Sharepoint Services (WSS) version 3 scenario.

This API supports the product infrastructure and is not intended to be used directly from your code. The TrustConfigurationData class supports the AD FS infrastructure and is not intended to be used directly from your code.

Defines the claim transformations used in the trust policy. These objects will be used for incoming corporate claim transformations from the TrustedRealm (account partner) this transformation is defined on.

Represents Windows domains that are allowed from this account partner, assuming this realm is a Windows realm. For example, this partner is in a forest which is trusted by the forest to which this Federation Server is joined.

A collection of TrustingApplication objects.

Defines the claim transformations used in the trust policy. The TrustingRealmClaimTransformation objects will be used for outgoing corporate claim transformations to the TrustingRealm (resource partner) that this transformation is defined on.

Administers the trust policy.

This class supports the AD FS infrastructure and is not meant to be used directly from your code. The base entry for a trust policy.

Creates trust policies. If you are using an active scripting language like VBScript, this is the recommended class for constructing or loading a TrustPolicy object.

The trust realm. This serves as the base class for trust entities like realms and applications in the Trust policy.

Defines information returned by an account store after validating user credentials.

Version information for a software application. Use VersionInformation when retrieving trust information.

Acts as the resource Web Server HttpModule. Enables ASP.NET applications to use AD FS for authentication.

This API supports the product infrastructure and is not intended to be used directly from your code. This class supports the AD FS infrastructure and is not intended to be used directly from your code. A WebSSO configuration handler object.

An exception thrown if the security token, based on collected credentials, pertains to a different principal than the current accelerator token.

Manages the list of certificates used by the Federation Server and is used by the TrustedRealm object. The RevocationFlags enumeration passed to the TrustedRealm object is used by the X509VerificationMethod Class. This is a helper object that is used in coding modifications to trust policies.

This class supports the AD FS infrastructure and is not meant to be used directly from your code.

This interface supports the AD FS infrastructure and is not intended to be used directly from your code. The IFederationServer interface provides a layer of abstraction to allow the LSAuthenticationObject to function in the same way regardless of whether the FederationServerService object is located in the same process.

This interface supports the AD FS infrastructure and is not intended to be used directly from your code. The IWebSsoTokenVerifier interface exposes token verification functionality through COM to the AD FS Web Agent Authentication Service.

The WebSsoAuthenticationEventHandler field supports the AD FS infrastructure and is not intended to be used directly from your code.

Specifies the type of account store to which the AccountStore object belongs.

The ClaimType enumeration identifies the claim type to choose.

Indicates the requested operation to an AD FS Web form.

This enumeration supports the AD FS infrastructure and is not intended for public use. An RSTRStatus enumeration is set on an RSTRResult object to indicate the result of the LsRequestSecurityToken and LsRequestSecurityTokenWithCookie methods.

Define the types of event logs and audit events written by AD FS components. The SingleSignOnEventLogLevel enumeration is part of the Federation Service’s trust policy configuration. It is also used in the configuration of the Federation Service proxy and claims-based web agent.

Identifies the type of WebSSO claim being used.