text: How to: Create My First Claims-Aware ASP.NET Application Using ACS
  Published: April 7, 2011
  Updated: June 20, 2014
  Applies To: Azure
  Applies To
  - Microsoft Azure Active Directory Access Control (also known as Access Control Service or ACS)
  Overview
  This topic describes the scenario of integrating ACS with an ASP.NET relying party application. By integrating your web application with ACS, you factor the features of authentication and authorization out of your code. In other words, ACS provides the mechanism for authenticating and authorizing users to your web application. For more information, see Web Applications and ACS.
  In this practice scenario, ACS authenticates users with a Google identity into a test ASP.NET relying party application.
  Steps for Integrating ACS with an ASP.NET Relying Party Application
  To integrate ACS with an ASP.NET relying party application, complete the following steps:
  - Step 1 - Create an Access Control Namespace
  - Step 2 – Launch the ACS Management Portal
  - Step 3 – Add Identity Providers
  - Step 4 – Add a Relying Party Application
  - Step 5 - Create Rules
  - Step 6 - Review the Application Integration Information
  - Step 7 - Create an ASP.NET Relying Party Application
  - Step 8 – Configure Trust Between ACS and Your ASP.NET Relying Party Application
  - Step 9 – Test the Integration Between ACS and Your ASP.NET Relying Party Application
  Step 1 - Create an Access Control Namespace
  For detailed instructions about how to create an Access Control namespace, see How to: Create an Access Control Namespace.
  Step 2 – Launch the ACS Management Portal
  The ACS Management Portal allows you to configure your Access Control namespace by adding identity providers, configuring relying party applications, defining rules and groups of rules, and establishing the credentials that your relying party application trusts.
  To launch the ACS Management Portal.)
  Step 3 – Add Identity Providers
  This section describes how to add identity providers to use with your relying party application for authentication. For more information about identity providers, see Identity Providers.
  To add identity providers
  In the ACS Management Portal, click Identity Providers in the tree on the left-hand side or click the Identity Providers link under the Getting Started section.
  On the Identity Providers page, click Add, select Google as the identity provider, and then click Next.
  The Add Google Identity Provider page prompts you to enter login link text (the default is Google) and an image URL. This URL points to a file of an image that can be used as the login link for this identity provider. Editing these fields is optional. For this exercise, do not edit them, click Save.
  Step 4 – Add a Relying Party Application
  This section describes how to add and configure a relying party application. For more information about relying party applications, see Relying Party Applications.
  To set up a relying party application TestApp.
  - SAML 2.0. For more information about tokens and token formats, see Token Formats Supported in ACS and “Token Format” in Relying Party Applications.
  - In Token encryption policy, select an encryption policy for tokens issued by ACS for this relying party application. For this exercise, accept the default value of None. For more information about token encryption policy, see “Token Encryption Policy” in Relying Party Applications.
  - In Token lifetime (secs), specify the amount of time for a security token issued by ACS to remain valid. For this exercise, accept the default value of 600. For more information, see “Token Lifetime” in Relying Party Applications.
  - In Identity providers, select the identity providers to use with this relying party application. For this exercise, accept the checked defaults (Google and Windows Live ID).
  - In Rule groups, select the rule groups for this relying party application to use when processing claims. For this exercise, accept Create New Rule Group that is checked by default. For more information about rule groups, see Rule Groups and Rules.
  - In the Token Signing Settings section, select whether to sign SAML tokens with the certificate for the Access Control namespace or with a custom certificate specific to this application. For this exercise, accept the default value of Use service namespace certificate (standard). For more information about token signing, see “Token Signing” in Relying Party Applications.
  Click Save.
  Step 5 - Create Rules
  This section describes how to define rules that determine how claims are passed from identity providers to your relying party application. For more information about rules and rule groups, see Rule Groups and Rules.
  To create rules
  On the ACS Management Portal Home page, click Rule Groups in the tree on the left-hand side or click the Rule Groups link under the Getting Started section.
  On Rule Groups page, click Default Rule Group for TestApp (since you named your relying party application TestApp).
  On the Edit Rule Group page, click Generate.
  On the Generate Rules: Default Rule Group for TestApp page, accept the identity providers selected by default (in this exercise, Google and Windows Live ID), and then click the Generate button.
  On the Edit Rule Group page, click Save.
  Step 6 - Review the Application Integration Information
  You can find all of the information and code necessary to modify your relying party application to work with ACS on the Application Integration page of the ACS Management Portal.
  To review the application integration information
  On the ACS Management Portal Home page, click Application Integration in the tree on the left-hand side or click the Application Integration link under the Getting Started section.
  The ACS URIs that are displayed on the Application Integration page are unique to your Access Control namespace.
  For this exercise, it is recommended that you keep this page open in order to perform the remaining steps quickly.
  Step 7 - Create an ASP.NET Relying Party Application
  This section describes how to create an ASP.Net Relying Party application that you want to eventually integrate with ACS.
  To create an ASP.NET relying party application
  To run Visual Studio 2010, click Start, click Run, type the following text, and then press Enter:
  devenv.exe
  In Visual Studio, click File, and then click New Project.
  In New Project window, select either the Visual Basic or the Visual C# template, and then select ASP.NET MVC 2 Web Application.
  In Name, type the following text, and then click OK:
  TestApp
  In Create Unit Test Project, select No, do not create a unit test project, and then click OK.
  In Solution Explorer, right-click TestApp, and then select Properties.
  In the TestApp properties window, select the Web tab,.
  Step 8 – Configure Trust Between ACS and Your ASP.NET Relying Party Application
  This section describes how to integrate ACS with the ASP.NET Relying Party application that you created in the previous step.
  To configure trust between the ASP.NET relying party application and ACS
  In Visual Studio 2010, in Solution Explorer for TestApp, right-click TestApp, and then select Add STS Reference.
  In the Federation Utility wizard, do the following:
  - On the Welcome to the Federation Utility Wizard page, in Application URI, enter the application URI and then click Next. In this demo, the application URI is.
  - A warning pops up: ID 1007: The Application is not hosted on a secure https connection. Do you wish to continue? For this demo, click Yes.
  - On the Security Token Service page, select Use Existing STS, enter the WS-Federation Metadata URL published by ACS, and then click Next.
  - On the STS signing certificate chain validation error page, click Next.
  - On the Security token encryption page, click Next.
  - On the Offered claims page, click Next.
  - On:
  Modify Web.config to enable request validation by adding the following code under the main system.web element:
  After you perform the update, this is what the above code fragment must look like:
  Step 9 – Test the Integration Between ACS and Your ASP.NET Relying Party Application
  This section describes how you can test the integration between your relying party application and ACS.
  To test the integration between the ASP.NET relying party application and ACS
  Keeping Visual Studio 2010 open, press F5 to start debugging your ASP.NET relying party application.
  If no errors are found, instead of opening the default MVC application, your browser is redirected to a Home Realm Discovery page hosted by ACS that asks you to choose an identity provider.
  Select Google.
  The browser then loads the Google logon page.
  Enter your test Google credentials, and accept the consent UI shown on the Google website.
  The browser then posts back to ACS, ACS issues a token, and posts that token to your MVC site.
  See Also
  ConceptsACS How To's