Search code examples
wif

Disable any cryptography in Windows Identity Foundation

I am only interested in the federation of corporate web services. So, how can I disable any encryption and signature in the active scenario ?

Solution

  • Encryption is not a problem. Simply don't enable encryption on the STS side.

    For signatures, there are two sides:

    • STS side. If your STS is AD FS 2.0, then it will always sign any token it gives out. (Or at least, my experiments did not reveal any way to remove all token-signing certificates.)

      You may be able to create a custom STS, e.g., based on WIF, to generate unsigned tokens.

    • RP side. Given that this question is tagged 'WIF', your web service is apparently implemented using WIF.

      When receiving a signed token, your WIF-based web service needs to trust this AD FS instance. (Or at least, I haven't found a way to have WIF trust just any token, without checking the token signature.)