Get Manager approval in SharePoint Designer 2010 - Step by Step

A fundamental condition that you always encountered when gathering workflow requirement is to get the user's manager approval, a tedious amount of coding to connect to active directory retrieve user profile information, get his manager login name, pass it as a parameter to the workflow, create a custom task for the manager with a notification. 

SharePoint 2010 Designer to the rescue, you can do all the above in 15 clicks, with ZERO code involved. Just by doing the following:

1. Open SharePoint Designer 2010 and connect to your SharePoint site.

2. Click Workflows and select the workflow type you need, for this presentation I'll use reusable workflow with All content types as my scope. But this doesn't affect the following logic, the same steps applies for the List and Site workflows.

3. From the Workflow ribbon select Actions > Collect Data from User, you can also select assign a to-do task but collect action from user allows you to create a custom task for the manager

4. This will show you the Action in the workflow editor.

5. The action is constructed from three parts:
   1. The data, which is the custom task that will be collected
   2. This user, which in our case the manager
   3. Output to variable: collect. Collect is  the task ID which you can change it, use it to refer to the task when you need to pass a variable through this task.

6. Clicking on data will allow you to create the custom task by starting the task wizard, open the wizard and click Next.
7. You will need to specify a Task name, and you can also specify a description. For now lets call the task "Review Task". And click Next

8. Now you can Specify the Task custom field by clicking Add and select the field type, I will specify two field:
   1. Approved as a choice with Yes/No.
   2. Comment as a text area.

More Here

Courtesy:http://blogs.technet.com/b/meacoex/archive/2010/11/01/get-manager-approval-in-sharepoint-designer-2010-step-by-step.aspx

More about → Get Manager approval in SharePoint Designer 2010 - Step by Step

Configuring ADFS Trusts For Multiple Identity Providers with SharePoint 2010

To begin with, start on the ADFS server to which your SharePoint site has the trust (we'll call it RP).

1. Open the federationmetadata.xml file from the ADFS server that users will be authenticating against (we'll call it IP) in the browser.  By default the location will be https://myIpAdfsServer/FederationMetadata/2007-06/FederationMetadata.xml.  If you get an untrusted certificate error in the browser you'll need to add the root authority certificate for the IP ADFS server's SSL to your trusted root authorities store.  NOTE:  This assumes that you have the same root authority certificate for both the SSL access to the IP ADFS web server and the IP ADFS token signing certificate.  If they are not the same then you need to add the root certificate authority for BOTH to the local RP ADFS server's certificate store.  To do that:
   1. Click through to view the web site, which should show the Xml file.
   2. Click on the View Certificates icon so you can see the SSL certificate that was used.
   3. Click on the Certificate Path tab.
   4. Double-click on the top certificate in the chain - this is the root authority certificate.
   5. Click on the Details tab.
   6. Click on the Copy to File... button and save the certificate in CER format to the local disk.  You can now close out all of the certificate dialogs and browser.
   7. Open up the Certificates MMC; if you don't have a shortcut for this then just start the MMC from the Run menu, Add snap-ins, and add the Certificates snap-in for the Computer (local).
   8. Expand the Trusted Root Certification Authorities node, right-click on the Certificates node, and choose the Import menu.  Follow the wizard to import the root authority .CER file you exported above.
   9.  
2. Open up the AD FS 2.0 Management application.
3. Expand the Trust Relationships node, then right-click on the Claim Provider Trusts node and select Add Claims Provider Trust...
4. Click the Start button to begin the wizard.
5. Leave the default option selected to Import data about the claims provider published online or on a local network, and in the edit box put in the address to the FederationMetadata.xml file (https://myIpAdfsServer/FederationMetadata/2007-06/FederationMetadata.xml by default) then click the Next button.  If your root authority certificate is correctly installed and the name can be resolved, then the wizard will continue to the next step.  If not, you have troubleshooting to do.
6. Provide a Display Name and optionally Notes, then click the Next button.

More Here

Courtesy:http://blogs.technet.com/b/speschka/archive/2010/11/24/configuring-adfs-trusts-for-multiple-identity-providers-with-sharepoint-2010.aspx

More about → Configuring ADFS Trusts For Multiple Identity Providers with SharePoint 2010

Configuring SharePoint to use a Specific Identity Provider in ADFS

One example where this may be necessary is if you have one ADFS server that is a sort of hub for other ADFS servers being used. If we follow this scenario out, suppose you have multiple web applications in SharePoint, and for each one your users should authenticate against a different Active Directory forest via ADFS. Well, using the procedures I described in the previous posting, you can create the trusts in ADFS to make that scenario work. However, the first time your users navigate to the SharePoint site that uses that hub ADFS server, or if they use the In Private features of IE to navigate to the site, they will get an intermediary page from ADFS before they log on. That intermediary page will list ALL of the claims identity providers and ask the user to select the one against which they wish to authenticate. Then they are redirected over to the login page for that identity provider (IP).



In a perfect world though, we don't want users to see that intermediary page - we'd rather redirect them immediately to the correct IP for authentication. Fortunately ADFS provides support for this through a "whr" query string parameter. If you add this query string parameter when navigating to ADFS then it will do a look up of the whr parameter to find a matching IP. If it finds one, then it automatically redirects you to that IP. In ADFS 1.x that parameter was a URN, like urn:foo:monkey. In ADFS 2.0 it takes the format of a Uri. To find the value you should use for the whr query string parameter, open up the AD FS 2.0 Management application. Expand the Trust Relationships...Claims Provider Trusts node, then double-click on the IP that you want used. Click on the Identifiers tab and you will see a grayed out edit box called Claims provider identifier:. The value in there is what should be in your whr query string parameter. For example, in my environment the IP identifier is http://tgen1.terri.local/adfs/services/trust. In order to get users of a web application to redirect immediately over to that IP I need to append the following to the normal login query string that SharePoint uses: &whr=http://tgen1.terri.local/adfs/services/trust When I do that I no longer see the IP selection page in ADFS, I just go directly to logging in.

More Here

Courtesy:http://blogs.technet.com/b/speschka/archive/2010/11/24/configuring-sharepoint-to-use-a-specific-identity-provider-in-adfs.aspx

More about → Configuring SharePoint to use a Specific Identity Provider in ADFS

Delegation of control with SCVMM 2008 R2 self service portal

This topic is about delegation of controle of virtual machines with Virtual Machine Manager self service portal.
you can make a profile with in VMM, and the user of that profile can only controle the virtual machines you want as an administrator.

First you login for example via SharePoint Portal to the Vitual Machine environment :




You login with the right user credentials to get in the VMM self service portal.
Then you get in the serverrole environment of Microsoft System Center Virtual Machine Manager.
The administrator gives you the rights to the right environment in SCVMM with the right Virtual Machine to manage with
delegation of controle.

You can connect all your own virtual machine with the right delegation of controle :
 

More Here

Courtesy:http://mountainss.wordpress.com/2011/04/20/delegation-of-control-with-scvmm-2008-r2-self-service-portal/

More about → Delegation of control with SCVMM 2008 R2 self service portal

Using SiteMinder authentication in Sharepoint

Introduction
Many enterprise IT environments use Netegrity SiteMinder (hereafter called SiteMinder) to secure Web applications and servers. When customers decide to move to MS SharePoint 2007 (MOSS), they want to continue to use SiteMinder for their existing Web environment, and also as the authentication mechanism for their portal.
This article is an example of the implementation of the solution that allows using the SiteMinder authentication with WSS 3.0.

The key technical points of the solution:
1. SiteMinder authentication.
2. FBA (Form Based Authentications) for SharePoint applications.
3. Custom login form.
4. Custom membership and role providers.

SiteMinder authentication

The SiteMinder authentication is used for single sign on (SSO) functionality. Once SiteMinder authenticates a user it adds a special HTTP header with the user name to each HTTP request. SiteMinder can also create an authentication cookie that can be used if you want client software integration, for example, if you want to modify a document from a document library, using MS Word.
Since the SiteMinder authenticates users, the SharePoint authentication can be, and should be bypassed, we trust that the user is already authenticated and her name is contained in the HTTP header. The custom login form pulls the UserID from the HTTP header, creates the authentication token and redirects the request to the destination page. The trick is to make the SharePoint framework to authorize (or deny) the authenticated user correctly. To resolve users and role names the SharePoint framework has to use custom membership and role providers.
FBA (Form Based Authentications) and custom login form.
Since we are going to use the custom authentication mechanism (not Windows authentication) we have to use the Form Based Authentication. Our form shouldn’t have any UI, and user shouldn’t even be aware that the form is called.
The FBA has to be set up on the SharePoint Central Administration website. After opening the site go to: Application management->application security->authentication providers
At this point make sure that you are changing the right SharePoint application, the application URL is displayed at the upper-right corner of the page.
When you see the authentication type for your application (it’s windows by default) click “Default” and you will be navigated to the “Edit authentication” page.
On this page you can set up the Form Based authentication and the membership and role providers.
If you want to be able to edit documents from document libraries using MS Office software, don’t forget to click the “client software integration” radio-button
After you set up the FBA authentication for a SharePoint application, the central administration web site changes the web.config file of the SharePoint application. It sets up the authentication to “Forms” and loginURL to _layouts\logon.aspx. In the modified web.config file of the SharePoint application you will see something like this:

More Here

Courtesy:http://mosssiteminderauthentication.blogspot.com/

More about → Using SiteMinder authentication in Sharepoint

Anonymous access SharePoint Web Application

Demonstrate how can we enable anonymous access for a sharepoint web applicaqtion, I already have enabled forms authentication and whenever I try to open the web application, following screen comes up that shows I must login to the site to create document libraries and lists.

Follow the steps to enable anonymous access for the web application.

• Move to central administration
• Choose correct web application where u want to enable anonymous access, by default central administration web application will be selected, you can change the selected application and then select the membership provider.

click on the provider and edit the settings, you will see the following screen and check “Anonymous Access” check box.



open your web application and login using your site collection administrator account and move to Advance permissions in people and group section, go to settings menu and click “Anonymous access” as per following screen

after clicking you will see following screen and select “Entire Site” and press ok

once it is done you have enabled anonymous access, now open your web application, you will see following screen

Highlighted red section on top right corner shows that you are not logged in to the site and you can access the main site page.

More Here

Courtesy:http://shafaqat309.wordpress.com/2011/01/16/anonymous-access-sharepoint-web-application/

More about → Anonymous access SharePoint Web Application

Sites vs Site Collections Sharepoint

When building a collaboration system, you will soon face a choice between using sites or site collections. In general I tend to favor multiple site collections. i.e. each project or department has their own site collection.

Storage Quotas

Most organizations don’t have an unlimited amount of storage. Keeping the data growth under control is important. In SharePoint it’s possible to impose a quota at the site collection level, but not at the site level. If you chose one big site collection, everybody would be dipping into the same pool. When a site collection is approaching it’s quota, the site collection owners will receive email notifications.

Security

In SharePoint, security groups are defined at the site collection level. i.e. visitors, members and owners. Using seperate site collections, it’s easy to keep track of all the groups and you know they are all related to the content stored in this site collection.

By using multiple sites in the same site collection, you would have to start breaking security inheritance at various levels and adding additional groups. i.e. Project 1 members, Project 2 members, etc. If you have a couple of hundred projects, you end up with several hundred SharePoint groups as well; keeping tabs on what people can do at various levels becomes tricky. When a site is deleted, the groups supporting it should also be removed; custom code is required.

If information sharing is important for your organization, some additonal steps need to be done if you use multiple site collections. One option is to give everyone read permission through a web application policy. The downside is if a site collection wants to hide its information; i.e. they are working on market sensitive information such as a corporate merger. A different approach is to have a system that synchronizes all of the visitor groups groups; e.g. using a timer job. Each site collection should then have a mechanism that allows them to opt out of this synchronization.

Content databases

A SharePoint web application can have multiple content databases; each content database equals one SQL database. This allows the amount of data to scale and at the same time keep the SQL databases at a size manageble for disaster recovery. Using administration tools, it’s possible to move a site collection between content databases; something that is not possible for a single site. This functionality can be important in balancing your load across several databases.

Navigation

One area where multiple site collections become a challenge is navigation. For sites within a site collection, sub sites can automatically appear in the navigation controls. These entries are only shown if the current user has access to them; security trimming.

Since site collections don’t have a hierachy and they don’t know about each other, there is not automatic support for cross site collection navigation. You will have to come up with your own system. i.e. using the object model to add entries to the navigation system, or read the navigation configuration from some other location.

Site queries

One web part that can be very handy is the Content Query Web Part. This allows you to perform a query that rolls up content from your site. Keeping the number of sites within a site collection low, these types of queries have an easier time.

Provisioning challenges

If you go for the multiple site collection approach, additional questions need answering.

* Who should be able to create new site collections?

* Should new site collections require approval? If so, by whom?

* A site collection will have a lifespan. How does one determine the end and what does one do then?

* Should the requestor become a site collection administrator? This allows them to do anything, including screwing up the whole site collection. This level of access may only be acceptable for certain individuals?

More Here

Courtesy:http://sharepointmystery.wordpress.com/2011/01/16/sites-vs-site-collections/

More about → Sites vs Site Collections Sharepoint

Restore Sharepoint Site Use Sharepoint Powershell

• Run Sharepoint 2010 Products -> Sharepoint 2010 Central Administrator -> Application management -> Manage Web Application click New

• And then fill name of website, port, register account for website click OK.
• Run Sharepoint 2010 Products -> Sharepoint 2010 Management Shell, write script :

Stsadm –o restore –url -filename <”(location and name of file).bak”>

•  
• Check Collection administrator

Run Sharepoint 2010 Products -> Sharepoint 2010 Central Administrator -> Application Management -> Change site collection administrators -> use username is administrator

More Here

Courtesy:http://tedyseptiady.wordpress.com/2011/01/07/restore-sharepoint-site-use-sharepoint-powershell/

More about → Restore Sharepoint Site Use Sharepoint Powershell

Connecting to SharePoint with Claims Authentication

In a nutshell, the process of connecting to SharePoint happens like this; Make a request, re-direct to an STS for login, post token from login to SharePoint’s STS (‘_trust’ site), post token from SharePoint’s STS to SharePoint, and then capture and store the ‘FedAuth’ cookie generated by the site. Then and only then, can you start accessing the data from the site by providing the ‘FedAuth’ cookie. The diagram below outlines the process in a slightly more detail…




The new SharePoint Client objects accessing SharePoint and most of its information much easier than before. Unfortunately; they are new, and new things have very little support. Fortunately, this fact didn’t keep us from long hours with Microsoft Tech Support (naturally calling me back right as I was about to walk out the door).


Now on to the good stuff…


The primary component of using the SharePoint Client objects is the ClientContext class. This class manages all of the interaction with your application and the SharePoint site. You tell the ClientContext what you want it to do and then tell it to execute. All-in-all, it makes the code much cleaner when pulling information from SharePoint.



Instead of muddying up my code, I decided to extend the ClientContext class and make it able to connect to a Claims-based site on its own. The key to extending the class, was in utilizing the ‘ExecutingWebRequest’ event. Here is where I was able to do all of my work and setup the connection with SharePoint.


But; before I continue, one warning. This is beta code and should be used at your own risk. I currently only having it working by retrieving authentication by impersonating the local context. So, it will not pass on any Claims Based credentials if used from a website (Windows Identity Foundation).


If anyone reading this can figure out a clean way to pass on the user’s token, please let me know. Thanks!
view source
print?
001 using System;
002 using System.Linq;
003 using System.Net;
004 using System.Net.Security;
005 using System.Security.Principal;
006 using System.ServiceModel;
007 using System.ServiceModel.Channels;
008 using System.Text;
009 using System.Web;
010 using System.Xml;
011 using Microsoft.IdentityModel.Protocols.WSTrust;
012 using Microsoft.SharePoint.Client;
013
014 namespace SharePointLibraries
015 {
016 public class ClaimsClientContext : ClientContext
017 {
018 // store this info at the class level for access by the ExecutingWebRequest event
019 private string SharePointRootUrl
020 {
021 get
022 {
023 // return (new Uri(_sharePointSiteUrl)).GetComponents(UriComponents.Scheme | UriComponents.Host, UriFormat.SafeUnescaped).ToString();
024 var siteUri = (new Uri(_sharePointSiteUrl));
025 return string.Format("{0}://{1}/", siteUri.Scheme, siteUri.Host);
026 }
027 }
028 private string _sharePointSiteUrl;
029 private string SharePointSiteUrl
030 {
031 get { return _sharePointSiteUrl.EndsWith("/") ? _sharePointSiteUrl : _sharePointSiteUrl + "/"; }
032 set { _sharePointSiteUrl = value; }
033 }
034 public string SharePointSiteRealm { get; set; }
035 private string _loginStsUrl;
036 private string LoginStsUrl
037 {
038 get { return _loginStsUrl.EndsWith("/") ? _loginStsUrl : _loginStsUrl + "/"; }
039 set { _loginStsUrl = value; }
040 }
041
042 // store the Saml token so that it can be used by successive requests
043 private static string IssuedSamlToken { get; set; }
044 private static DateTime IssuedSamlTokenExpireDate { get; set; }
045
046 ///

047 /// Public constructor for all three being strings
048 ///

049 ///
050 ///
051 ///
052 public ClaimsClientContext(string sharePointSiteUrl, string sharePointSiteRealm, string loginStsUrl)
053 : base(sharePointSiteUrl)
054 {
055 if (sharePointSiteUrl == null) throw new ArgumentNullException("sharePointSiteUrl");
056 if (sharePointSiteRealm == null) throw new ArgumentNullException("sharePointSiteRealm");
057 if (loginStsUrl == null) throw new ArgumentNullException("loginStsUrl");
058
059 // save the settings
060 SharePointSiteUrl = sharePointSiteUrl;
061 SharePointSiteRealm = sharePointSiteRealm;
062 LoginStsUrl = loginStsUrl;
063
064 // specify the default credentials to use
065 Credentials = CredentialCache.DefaultCredentials;
066
067 // add a handler for the ExecutingWebReques event to provide the SAML token
068 // this.ExecutingWebRequest += new EventHandler(ClientContext_ExecutingWebRequest);
069 ExecutingWebRequest += ClientContext_ExecutingWebRequest;
070 }
071
072 ///

073 /// Public constructor for Site Url being a Uri
074 ///

075 ///
076 ///
077 ///
078 public ClaimsClientContext(Uri sharePointSiteUrl, string sharePointSiteRealm, string loginStsUrl)
079 : base(sharePointSiteUrl)
080 {
081 if (sharePointSiteUrl == null) throw new ArgumentNullException("sharePointSiteUrl");
082 if (sharePointSiteRealm == null) throw new ArgumentNullException("sharePointSiteRealm");
083 if (loginStsUrl == null) throw new ArgumentNullException("loginStsUrl");
084
085 // save the settings
086 SharePointSiteUrl = sharePointSiteUrl.ToString();
087 SharePointSiteRealm = sharePointSiteRealm;
088 LoginStsUrl = loginStsUrl;
089
090 // specify the default credentials to use
091 Credentials = CredentialCache.DefaultCredentials;
092
093 // add a handler for the ExecutingWebReques event to provide the SAML token
094 ExecutingWebRequest += ClientContext_ExecutingWebRequest;
095 }

More Here

Courtesy:http://fredericloud.com/2011/01/11/connecting-to-sharepoint-with-claims-authentication/

More about → Connecting to SharePoint with Claims Authentication

Sharepoint 2007 : Configure and start the Microsoft Single Sign-On service

To use single sign-on, the Microsoft Single Sign-On service (SSOSrv) must be installed on all Microsoft Windows front-end Web servers in the farm. SSOSrv must also be installed on all servers running Excel Services. If the Business Data Catalog search is used, SSOSrv must also be installed on the index server.
SSOSrv is configured by using the Services console. When configuring the service, a logon account is required. The logon account must meet all of the following criteria:

• Must be a domain user account. It cannot be a group account.
• Must be an Office SharePoint Server farm account.
• Must be a member of the local Administrators group on the encryption-key server. (The encryption-key server is the first server on which you start SSOSrv.)
• Must be a member of the Security Administrators role and db_creator role on the computer running Microsoft SQL Server.
• Must be either the same as the single sign-on administrator account, or a member of the group account that is the single sign-on administrator account.

Configure and start the Microsoft Single Sign-On service

1. On the server, click Start, Control Panel, Administrative Tools, and then click Computer Management.
3. In the Computer Management console, expand Services and Applications, and then click Services.
4. Right-click Microsoft Single Sign-On Service, and then choose Properties.
5. On the General tab, change the Startup type to Automatic.
6. On the General tab, under Service Status, click Start.
7. Click OK to save your changes and close the Properties window.
8. Repeat steps 1 through 6 for each applicable server in the farm.Source : http://technet.microsoft.com/en-us/library/cc262932.aspx#Section1

More Here

Courtesy:http://panca.wordpress.com/2009/04/07/sharepoint-2007-configure-and-start-the-microsoft-single-sign-on-service/

More about → Sharepoint 2007 : Configure and start the Microsoft Single Sign-On service

Configure Sharepoint (MOSS) Single Sign-On

.

1. http://www.thorprojects.com/blog/archive/2008/08/02/moss-single-sign-on-setup-step-by-step.aspx
2. http://www.sharepointblogs.com/michael/archive/2007/07.aspx
3. http://www.sharepointblogs.com/llowevad/archive/2007/06/25/sharepoint-2007-single-sign-on-setup.aspx

First step is to create 2 domain security groups (SSOADMINS and SSOMANAGERS), set the Group Scope as Global and Group Type as Security.
Create a domain user account (SSOADMIN) and make it a member of the SSOADMINS group, and also make SSOADMIN a member of the Administrators group on the encryption key server (SSO service server – see below). Also make any other user accounts who will manage Sharepoint SSO service settings members of the SSOADMINS group.
Add user accounts as members of the SSOMANAGERS group, for those accounts who will manage Single Sign-On Enterprise Application Definition settings.
Ensure that the SSOADMIN user is a member of the local Administrators group on each WFE server.

Create a login for the SSOADMIN user on the Sharepoint SQL Server machine and assign them to the dbcreator and securityadmin roles.
After making changes to domain accounts / groups, it might be a good idea if your re-logon/restart your MOSS server. Also it may be worthwhile logging into your MOSS server as the SSOADMIN user while configuring SSO Server settings.  Last time I configured SSO I kept getting the “You do not have sufficient rights to perform this operation” error message, which I solved by logging in as the SSOADMIN user to make those changes.
Configure the Microsoft Single Sign-On Service (services snap-in) to start automatically using the SSOADMIN user account for it’s logon details. This must be done on each WFE server and also on the Indexing server.
* Note: Do not start the SSO service on any server yet, the first server on which the SSO service is started becomes the encryption key server.
On the machine you’ve decided will be the encryption key server, start the SSO service. On this machine, log into Sharepoint Central Admin.
Add the SSOADMIN user to the farm administrators group.
In Site Settings -> Permissions, add the SSOADMINS and SSOMANAGERS groups and give them Read permissions.
In Operations -> Service Accounts, select the Single Sign-On service and set the credentials to the SSOADMIN user account.
In Operations -> Manage Settings for Single Sign-On, select Manage Server Settings; 

Set the Single Sign-On Administrator Account to the SSOADMINS group.
Set the Enterprise Application Definition Administrator Account to the SSOMANAGERS group.
Leave the remaining options as default and click OK.
If you see an error message displayed to the effect that you don’t have enough permissions, rights, access denied etc, check that you’ve configured the logins on SQL Server, made the SSOADMIN a local Administrator, finally you might login as SSOADMIN while you make these changes.
In Operations -> Manage Settings for Single Sign-On, select Manage Encryption Key;
Click Create Encryption Key, once this is finished you’ll probably want to back it up.
At this point you’re ready to start creating Enterprise Application Definitions and setting credentials for those EAD’s.

More Here

Courtesy:http://platinumdogs.wordpress.com/2008/10/30/configure-sharepoint-moss-single-sign-on/

More about → Configure Sharepoint (MOSS) Single Sign-On

Leverage and Extend Claims based identity in SharePoint 2010

Windows Identity Foundation (WIF) is the platform on which SharePoint 2010 claims authentication is based. WIF, which is fully supported in SharePoint 2010, ADFS 2.0, ASP.NET, Windows Communication Foundation (WCF), and any other .NET application you care to develop, provides the infrastructure necessary to generate, transmit, and process claims-based identity in a simple and straightforward manner. It removes the roadblocks imposed by legacy authentication schemes like NTLM and Kerberos and puts control directly into the hands of developers, users, and IT security professionals. long story short, it’s a framework written to help solve identity issues common in the of cloud computing and service-oriented architecture.


The idea of claims based identity is one that many people are willing to try. Getting accurate information out there to the public though does take time.

The important point is this is based on industry standards. Many different entities are on board along with Microsoft in this matter. The digital world continues to give us new opportunities and those involved believe that this will help all of us to get the most out of it. There is a strong foundation in place to continue building upon. The use of AD FS v2, CardSpace, and Windows Identity Foundation are all important pieces of this puzzle.


As a demonstration of these capabilities, I’ll show how SharePoint 2010, WCF,and WIF can be put together to solve the identity delegation problem. In this demo session part 1 I start establishing the trust relationship between ADFS 2.0 and SharePoint with PowerShell and demonstrate how the claims get into SharePoint.Then we build and deploy a claims viewer Webpart with WIF programming model. In part 2 We start with a web service that is front-ending line-of-business information stored in a SQL database. Then, we’ll configure it to use WIF to request the calling user’s claims from SharePoint and process the token so that authorization decisions can be made. we’ll surface this information in SharePoint 2010 as an External Content Type using Business Connectivity Services (BCS).

More Here

Courtesy:http://sptechpoint.wordpress.com/2010/11/23/whats-new-in-sharepoint-2010-security/

More about → Leverage and Extend Claims based identity in SharePoint 2010