.net - When is it worth implementing a WIF solution? -

i'm trying build / architect security solution intranet application , i'm wondering if implementing wif level solution worth it, given requirements.
essentially, have following things considerations

• the general platform asp.net mvc 3 / windows servers / sql server 2008 r2 database.
• information comes our system outside vendor provides workflow software solution
• since vendor software covers part of company's typical workflow, they'll sending data rest call. our end uses wcf rest calls receive data.
• a vpn tunnel supposed built outside vendor's servers part of security.
• there's pressure top vpn isn't enough security. also, there authorization issues (some users shouldn't have access data), should have identifies users on our end vendor's end insure information right person, proper rights make these changes.
• the outside vendor has own security system, nothing can tap into, i'm not sure what, if anything, can synchronize security.
• the piece of workflow pick handled via mvc 3 / sql server.
• our company uses active directory user management, , i'd if can lean on if possible. ideally, i'd not introduce yet password our users, since they'll have work logins, outside workflow vendor logins, , logins yet other vendors.
• while solution going part of company i'm in now, might roll out other sister companies under our same active directory.
• while using workflow solution limited users in active directory, we'd have outside users we'd prefer not give active directory accounts view reports running on ssrs.
  
  

sorry if long, hope providing information possible, can best answers / solutions / practices / recommendations possible problem. thanks.

it's worth installing wif if want future proof solution. wif enables claims , microsoft building apps around claims e.g. sharepoint 2010, crm dynamics 2010, office 365 , azure acs built around claims, wif , sts.

once have infrastructure installed, it's relatively easy federate other partners. traditional way enable trust between ad add more , more companies run problems ip, netbios etc. clashes.

wif addresses number of points have raised.

• allowing external users access without adding them local ad
• an additional encryption layer on , above iis ssl.
• allocating roles users authorisation (both coarse , fine grained)
• sso
• built around ad