I think it's great that we finally have support for Flash/Silverlight on the ACS. However, I think the support is poorly implemented.

The current policy is expressed as

<cross-domain-policy>
<allow-access-from domain="*" secure="true" />
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" secure="true" />
<allow-http-request-headers-from domain="*" headers="*" secure="false" />
</cross-domain-policy>

I'd prefer to be able to add the domains that can access the service from Flash/SL via the administrative UI since my use cases for ACS are for single applications, not for the world at large.

Currently, wreply is not supported. When an ADFSv2 user signs out they get a dead end page like this:

https://tlsadmin.accesscontrol.windows.net/v2/wsfederation?wa=wsignoutcleanup1.0&wreply=http://localhost:2600/Account/SignIn

The wreply parameter is an industry standard and should be implemented:
http://social.technet.microsoft.com/wiki/contents/articles/ad-fs-how-to-invoke-a-ws-federation-sign-out.aspx

http://msdn.microsoft.com/en-us/library/bb608217.aspx
http://download.boulder.ibm.com/ibmdl/pub/software/dw/specs/ws-fedpass/ws-fedpass.pdf

The second ( related )issue I’m having is that I’m trying to deauth ADFS and Facebook. I need to use the wreply parameter to redirect the user off the ACS host, and back on some “normal” user page.

You might ask why am I redirecting to the ACS? It’s because Facebook is requiring me to. And since the Facebook TOS requires me to implement sign out features (that actually log someone out of facebook, not just my RP) then I have to redirect them to the ACS signout page.

The issue is that the user experience is horrible. They dead end at a page that tells them to close the browser windows. This is a no-go for me since my application is used in Kiosks where it’s not possible to close the browser window, or navigate using the url. Plus it’s bad design.

I'd like to see a single Issuer store for both ACS configuration and the service bus configuration. SInce you already have to grant issuers specific rights for the service bus I don't see why I need to maintain two stores of issuers for both access to the service bus AND for my own services. I should be able to define an issuer once, then grant them rights to my service bus and/or ACS from there.

We want Content Based Routing in Azure App Fabric. How can you take it out of it? A service Bus is not complete without one. I suggest we have it for XML/JSON type messaging, and it must be durable!

I mentioned to customer that we can host their services in App Fabric, and we can leverage Content Based Routing. I am somewhat dissapointed when I worked on the SDK, that this is not their! So what do I do? I do not think using BizTalk just for the routing capabilties is suffucient, App Fabric MUST have this built in, if it is to surivive and beat the competitors. It is application driven and shouls therefore be able to intrinsically route certain message types based on type or content!

Sorry to be a bit snarky here. I initially was extremely excited that Microsoft was adopting uservoice, this is a great step forward, but without showing activity in accepting ideas people may turn elsewhere. In the same time competitors such as Amazon have added considerable new features, I'm hopeful that Azure will be a great player in the market.. seeing some action here would certainly help.

Currently, I guess there is no WS-* support in ACS for us to do multi-tenant federation from Web role.
I have seen examples for REST services but how about web role?
We can do this on premise by ADFS adding whr parameters to the querystring etc.. but how to do it on azure using ACS and web role.

This is must for any SaaS application

The nameidentifier claim containing a made up ID unique to my application is not sufficient for authenticating a user. With no way to get additional user identifiable information, a user could authenticate with Live and then fill out a local profile on my application for whomever they wanted. They could claim to be Bill Gates, I would have no way of verifying that based on the nameidentifier claim coming from LiveID.