Claims Based authentication in SharePoint 2010

Microsoft have recently updated their protocols information for SharePoint, incorporating a number of SharePoint 2010 changes. Included in the updates is information about claims based authentication in SharePoint 2010.

As we collect more information, this page will be updated. Some notes so far:

The protocols mentioned are:

SharePoint Claim Provider Service Web Service Protocol Specification

SharePoint Security Token Service Web Service Protocol Specification

As expected both protocols are implemented on top of SOAP over HTTP.

Claim based authentication mode

It appears that SharePoint web applications can be put in to claim-based authentication mode. (IsClaimsMode method.)

Claim providers

There are four types of claim providers: System, AllUsers, Group, and People.

System claims can be of several types:  farmId, processidentitylogonname, processidentitysid, windowstoken/handle , processid

Value types appear to be a GUID (persisted as a string) or a string.

API

SPClaim is a claim associated with an entity.