Currently, I am in the process of developing a website that utilizes a SAML token for single sign-on security measures. Within this site, there is a form containing multiple input fields that are responsible for triggering updates and validation across various other input fields and table data.
All validation checks and updates are processed on the server side. Whenever a value within the form is updated, a JavaScript function is utilized to inform the server through a WCF JSON web service. This service then returns new values as well as any necessary validation messages.
However, the challenge lies in ensuring that this web service is secure and can only be accessed by users authenticated with a SAML token obtained during login on the platform's website.
[Edit: further investigation conducted] Following authentication, the SAML token is consistently transmitted to the server via a FedAuth cookie. It has been determined that including the token in the JSON or AJAX Get header is unnecessary. Although I attempted to delegate verification of the cookie to Windows Identity Foundation (WIF), I was unsuccessful. Subsequently, I disabled federated authentication on the JSON service and instead focused on retrieving the cookie from HttpContext. While this approach does work, I am encountering difficulties when attempting to decrypt the information retrieved.
Are there any individuals who possess expertise in this area? Is there anyone available with relevant experience?