StarterSTS Documentation

Initial setup

This is a quick checklist for setting up StarterSTS. You can also watch video which walks you through the initial setup process.

Pre-requisites

This document assumes that you have already correctly set up your operating system and IIS 7.x (StarterSTS 1.0 also works on IIS 6 - see the remarks at the end of this document). Furthermore IIS needs to be configured with an SSL certificate. This can be a self-generated certificate, but it must be trusted by your browser.

You also need to install the Windows Identity Foundation (and maybe the SDK if this is a dev box).

Setup

• Copy the StarterSTS web files to a directory of your choice and make sure that the application account has read access to it.
• Go to IIS manager and map an appplication to this directory.
• You should now be able to browse to the default page using SSL (if not try to fix this first before moving on).

Certificate Configuration

The first thing that you should configure are the certifcates that are used by StarterSTS. This is done in configuration/certificates.config You have to provide the path to certificate store for the SSL certificate and the token signing certificate (which can be the same as the SSL certificate).

It is easiest to reference the certificate by thumbprint. To find out the thumbprint, use the certificate MMC snap-in to navigate to the SSL certificate - open the properties and copy the thumbprint value to the clipboard. Then use that value in certificates.config for the certificate called SSL. In most cases you can use the same thumbprint value also for the SigningCertificate certificate. Of course you can also use two separate certificates.

Don't use the same thumbprint for the BridgedSigningCertificate certificate. This should be a separate certificate. Since this is used for the OpenId bridge feature only, this does not need to be setup now.

In any case, your IIS application account needs read access to the certificate's private key. You can use the certificate MMC snap-in to configure that - simply navigate to the certificate and right click All Tasks / Manage Private Key to set the ACL.

Provider Configuration

The next step is to connect StarterSTS to your user data. There are certain routes you can take from here.

You don't have a user store and want to start from scratch

In this case you have to create a user database first. Use the aspnet_regsql tool from the .NET Framework SDK for this purpose. After that open the /configuration/connectionString.config file and make sure the ProviderDB connection string points to your provider database.

You can now populate your database with users, roles and profile information using any compatible tool. You can e.g. use the IIS manager (navigate to your StarterSTS application first).

You already have a ASP.NET SQL Server provider database that you want to use

In that case you only need to adjust the connection string to the database in /configuration/connectionString.config.

You want to use a custom provider

In this case you need to adjust the provider configuration in web.config. Here you'll find more information about provider compatibility.

Verifying the installation

Now launch StarterSTS. Try to access the federation metadata document, try to login and edit the profile. Also try to retrieve an information card. This should all work now - if not verify the above steps or contact me via the codeplex forum.

Remarks for IIS 7.x

• web.config specifies SSL settings for clientCertificate.aspx. This is not allowed at the application level by default. You either have to change the SSL delegation settings in IIS manager to read/write or configure the SSL configuration for the page using IIS manager (which puts it into machine.config). You then may have to manually delete the location element from web.config.

Remarks for IIS 6

StarterSTS is built and tested on IIS7.x. Nevertheless it should work on IIS6 as well. Some notes:

• You must route all requests through ASP.NET. Use a wildcard mapping aspnet_isapi for the StarterSTS vdir.
• The location element for federation metadata in web.config must be changed to system.web from system.webServer.
• SSL settings for clientCertificate.aspx must be done manually in IIS6 manager.