Introduction

The ACS Control for Window Phone allows your phone applications to outsource user authentication to the Windows Azure Access Control Service (ACS). This service, enables your users to log in by reusing their existing accounts from identity providers such as Windows Live ID, Google, Yahoo, Facebook and possibly from their Active Directory. If you want to know more about ACS, you can take a look at the dedicated hands-on labs in the Windows Azure Platform Training Course.

This package provides a Silverlight Control for Windows Phone to interact with ACS, that you can include in your Windows Phone applications to take care of all the runtime interactions with this service. Additionally, this package includes a base log in page that uses this control and it is ready to be used in your phone application. All that is left to do for you is to configure your ACS namespace via its handy management portal (like specifying your preferences such as the identity providers you want to enable in your relying party), and integrate the log in page into your existing Windows Phone application.

Prerequisites

Configuration

Configuring your ACS namespace settings

  1. First of all, make sure to have a Windows Azure Access Control Service (ACS) namespace with a fully configured Relying Party Application to receive a Simple Web Token (SWT).
  2. After that, you need to configure your ACS namespace settings so they can be used by the control. To do this, go to the Resources folder and open the AccessControlResources.xaml file.
  3. In this file, replace the youracsnamespace and yourrealm placeholders with your ACS namespace and your Relying Party realm respectively.

Integrating the base log in page with your Windows Phone application

This package includes a base log in page that uses the ACS Control for Windows Phone to allow users to authenticate using their favorite identity provider. In order to integrate this page with your Windows Phone application navigation flow review the following steps.

Important: Take into account when designing the navigation logic and flow of your Windows Phone application, that pressing the device's Back button from the first screen of your application must close the application. Otherwise, your application will not be accepted in the Windows Phone Marketplace.

  1. Make sure to link to the /Pages/LoginPage.xaml page from an existing page in your application, or, alternately, set it as the default page for your application in the WMAppManifest.xml file as is shown in the following image.



  2. Once the page is included in your navigation flow, you need to replace the TODO comments in the Pages/LoginPage.xaml.cs file with your application navigation logic. In the following picture, for example, you can see how to navigate to another page only when the user is correctly authenticated.

Handling the token returned by the Identity Providers

  1. The ACS Control for Window Phone automatically saves the Simple Web Token obtained from the selected identity provider to the phone's Isolated Storage and makes it available to your application as an application resource called swtStore.
  2. The only claim type supported out-of-the-box for all the built-team identity provides in Windows Azure Access Control Service is the NameIdentifier. To access the authenticated users' NameIdentifier claim value, you can use the following snippet.
    3. var simpleWebTokenStore = Application.Current.Resources["swtStore"] as SimpleWebTokenStore;

var userNameIdentifier = simpleWebTokenStore.SimpleWebToken.NameIdentifier;
  3. To access the rest of the user's claims, you can query the Claims dictionary of the SimpleWebToken class, and extract the ones you require. For instance, to access the value of the Name claim type, you can use the following snippet.
    4. var simpleWebTokenStore = Application.Current.Resources["swtStore"] as SimpleWebTokenStore;

var name = simpleWebTokenStore.SimpleWebToken.Claims[ClaimTypes.Name];

Additional information