When you start working with Windows Azure in your spare time there are quite a few things that you miss.
I knew that it was possible to manage Windows Azure with multiple accounts, but since I was the only one logging into my instance, I never bothered to look into it. Well as it turns out, I needed to be able to manage Azure from a separate Live ID. It's pretty simple to do. You get into your subscription, navigate to User Management under the Hosted Services tab, and then you add a new Co-Admin.
Turns out that you can't manage ACS this way though. You don't have access to the namespaces as the Co-Admin. Crap. That's really what I wanted to manage with the separate account. After a minute of swearing at the control panel, I logged into ACS with my original account and looked around.
Portal Administrators
Aha! It was staring me right in the face:
There is a full MSDN article on how to deal with Portal Administrators.
Upon clicking the link you are given a list of current administrators. I wanted to add one.
When you add an administrator you are given a list Identity Providers to choose from. Interesting.
This means that I can manage this ACS namespace using any IdP that I want. I already have ADFS created as an IdP, so I'm going to use it. Getting Single Sign-On is always a bonus.
It asks for a claim type. When the ACS management portal receives a token, it will look for this claim type and compare it's value to the Identity claim value. If it matches the value, you are authorized to manage the namespace. I chose email address. It seemed simple enough. To log in I just navigate to https://syfuhs2.accesscontrol.windows.net/ and then gives me the default Home Realm Discovery page:
I've already preconfigured ACS to redirect any email addresses with the objectsharp.com domain to our ADFS instance. Once I click submit it redirects to ADFS, I authenticate using Windows Authentication, and then I'm back at the ACS Control Panel. The next time I go to log in, a cookie will be there and the Home Realm Discovery page will see that I logged in with ADFS last time, so it will list that option first:
It just so happens that ObjectSharp is Awesome.
Now how cool is that?