6

I am not a SharePoint expert by any means, and I've been having a really hard time finding the right information on this. Help, please!

I need a way to cause a claim token established with a call to SPFederationAuthenticationModule.SetPrincipalAndWriteSessionToken to recalculate the claims on the token without logging out the current user. Is there any way to do this?

Some background on why I'm asking this:

We use a custom role & membership provider for authN/Z on our custom SharePoint 2010 web application. Without getting into the details of why (which are complex) the role provider creates dynamically generated role names for a user based on the state of the user in the main app database; these roles represent the permissions for the user and are used inside SharePoint to determine the user's access to sites and site collections in the app.

There are ways within our app for the user to change their permissions, effectively adding new roles through the role provider, granting the user additional access within the app. The problem we are running into is that the Claims based auth which we are forced to use in SP2010 precomputes permissions at login and encodes those permissions in the session token -- effectively forcing us to ask the user to log out and log back in before they can obtain their new permissions. This is creating all sorts of usability issues, hence my question.

Is there some way to programmatically recompute the session token without logging out the user?

Or are we barking up the wrong tree? In my normal happy ASP.NET land I'd use Forms Auth, which computes authorization at every request rather than at login. Unfortunately, that doesn't appear to be an option in SP2010, and I'm rather stuck with SharePoint at the moment. Is there some other action we can pursue?

4
  • not sure that I understand the problem - from what I gather according to this msdn.microsoft.com/en-us/library/ee557572.aspx you can recalculate the claims by creating a new SecurityToken (same user/pw - different ID)... is this what you are after ? otherwise please elaborate...
    – Yahia
    Nov 16, 2011 at 6:07
  • @Yahia Yes, this is exactly what I'm after. But newing up the SecurityToken requires the user's password -- something I don't just keep lying around. I could ask the user for their password, but that would be equivalent to logging them out and logging them back in. I could hold the password in session, but that would be heinously insecure. There's got to be a way to do this without needing the password.
    – Randolpho
    Nov 16, 2011 at 6:21
  • Have you checked into RenewToken (see msdn.microsoft.com/en-us/library/ms551886.aspx) followed by a call to ValidateToken ? IF that doesn't do what you need I suspect you will have to either write your own custom SecurityToken/Provider etc. or keep the PW around in-memory (which I agree isn't good!).
    – Yahia
    Nov 16, 2011 at 7:13
  • Another point might be to try Authenticate (see msdn.microsoft.com/en-us/library/…) to simulate the dynamic behaviour you described with "Forms Auth" case...
    – Yahia
    Nov 16, 2011 at 7:19

2 Answers 2

5

Ok, after much research prompted by @Yahia's links, I discovered the answer to my problems in a blog post. Worked like a charm. I'll give an overview below, in case the link ever breaks:

Windows Identify Foundation's SessionAuthenticationModule, which is used as SharePoint 2010 auth framework, has a nifty little event that you can hook called SessionSecurityTokenReceived, which is called at the beginning of every request. By hooking this event, I can force SharePoint to request an authorization renewal without forcing the user to re-enter credentials.

The code is straightforward and sweet:

var sam = sender as SessionAuthenticationModule;
var logonWindow = SPSecurityTokenServiceManager.Local.LogonTokenCacheExpirationWindow;
var newValidTo = DateTime.UtcNow.Add(logonWindow);
e.SessionToken = sam.CreateSessionSecurityToken(
    e.SessionToken.ClaimsPrincipal,
    e.SessionToken.Context,
    e.SessionToken.ValidFrom,
    newValidTo,
    e.SessionToken.IsPersistent);
e.ReissueCookie = true;

I've tested it, and the approach definitely works, but there are drawbacks:

  1. The call to CreateSessionToken needs existing data from the current session token, which it appears I can only get from the event. That means this approach can only be done in the context of a new request. Since the event fires for every request and I only want to refresh auth in certain circumstances, I'm forced to test every request for a prompt to refresh auth. The simplest approach is to create a magic URL, such as "/refreshToken?redirectUrl={url}" that you test for in the event handler. Simply redirect to this URL when auth has been updated and the token needs to be refreshed.
  2. Hooking the event is problematic -- you can't do it statically because the module doesn't exist when static constructors are built. Ultimately, you're best off doing it in a custom HttpModule or global.asax -- both require updating resources that can't be touched via a .WSP file deployment (web.config or the global.asax file), so either approach causes deployment issues, at least for the first deployment. I chose to go the global.asax route.

In all, a satisfying hack. Got the job done, with a minimal workaround.

1
2
+500

I see several possibilities:

  • try using SPRoleAssignment and SPGroupCollection on the respecitve SPUser to add groups/roles dynamically

  • use RenewToken followed by ValidateToken
    Whether this really does what you want depends on how the caching is implemented (i.e. does the renew/validate in turn invalidate the cached Claims)

  • keep the password around in-memory, issue a new token (with same user/pw, but new ID!) then call ValidateToken
    I think this is the easiest option BUT at the same time a security nightmare (i.e. bad practice)!

  • call Authenticate whenever you want to check for a claim
    Whether this works depends on your custom provider... if it works it will cost performance though...

  • implement your custom SecurityToken (and provider and...)
    This will do what you want but means lots of work.

Other helpful resources include:

2
  • Thank you very much for the reply. I will investigate your suggestions and let you know what I find out.
    – Randolpho
    Nov 16, 2011 at 15:37
  • Ok, after much research promted by some of your links, I found the answer. None of your suggestions worked, so I'm not accepting your answer, but I will give you my bounty for your help. I very much appreciate it. I'll post how I solve the problem in a separate answer.
    – Randolpho
    Nov 18, 2011 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.