“Geneva” Team Blog : Beta 2

CardSpace Geneva Beta 2 Samples Package

CardSpaceBlog — Tue, 28 Jul 2009 21:08:00 GMT

With the release of Beta 2 comes a set of samples specifically targeted towards CardSpace developers. Whether you are a web developer or a C++ programmer, you are sure to learn something new in our CardSpace Geneva Beta 2 Samples.

The samples pack covers three broad areas:

· A series of incremental web page samples showing how to invoke CardSpace, culminating in a sample that shows error handling and progress spinners for long-running operations like policy and token retrieval.

· A sample that shows using Geneva Framework’s WSFederationAuthenticationModule to protect a web site with CardSpace credentials.

· A sample for VC++ programmers that demonstrates CardSpace’s API for native programs. If you have wanted to include the CardTile in your own program or browser extension, this is for you!

To install the samples, just unzip them and follow the instructions in the included readme file. Enjoy! If you have any feedback, please share it in the forums.

Information Card Issuance: a small step for "Geneva" Server, a big leap for Federated Identity

CardSpaceBlog — Fri, 29 May 2009 05:26:00 GMT

Imagine this: you have been following this blog and have decided to try “Geneva” Beta 2. You have gone to the connect site and downloaded the "Geneva" platform components, installed them, configured the server, used the framework to write a claims-aware uber cool application, and set up trust between your server and the application. Now your users can log in and use your application and you can manage access easily. But that uses only two out of the three "Geneva" products. What does it mean to incorporate CardSpace "Geneva" into this scenario? From the server perspective, it means configuring information card issuance.

Intro

The "Geneva" Server in this scenario is configured to use the active directory that contains all your users. We call this role an Identity Provider STS because it authenticates users and produces tokens about their identities. One of the powerful features that “Geneva” Server gives an STS is the ability to issue cards that CardSpace "Geneva" stores and allows you to use to authenticate. For more information on cards see: http://blogs.msdn.com/card/archive/2008/05/20/backing-a-managed-card-with-alternate-credentials.aspx

Each part of our scenario needs to be properly configured:

· Your users need to have CardSpace “Geneva” installed (or compatible Identity Selector)

· The Server needs to issue cards.

· The application needs to support card selector log in

"Geneva" Server Card Issuance

Configuring a card is simple: the initial configuration wizard sets all required parameters. You can update any and all of them at any time. List of the parameters you can set:

· Card name

· Card image (typically your organization's logo)

· Privacy Notice (optional)

· Authentication type (more in the next paragraph)

· Certificate to sign the card (this is located in the certificate settings)

Choosing an authentication type depends on your deployment, and the strength of authentication you wish to enforce. “Geneva” Server Beta 2 supports three types of authentication:

· Windows – by selecting this type, CardSpace performs Windows Integrated Authentication, which only works when the user is connecting from the internal network.

· Certificate – by selecting this type, CardSpace authenticates with a user certificate located on the user’s machine. This type works well for smart cards, and is especially useful for authenticating users outside of the corporate network in a highly secure way.

· Username and password – by selecting this type, CardSpace prompts the user for their domain user name and password. This type also works for authentication outside the corporate network.

The order of the authentication types will always be first Windows if present, next Certificate if present and last Username Password if present. The implication of this is that if you can turn on two authentication types, for example Windows and Certificate. Then inside a corporate network, users would automatically get authenticated with Windows Integrated Authentication. Outside a corporate network where Integrated Authentication is not available, authentication falls down on the next authentication type and users will get authenticated by their user certificate.

The initial configuration wizard does one more thing for you. It deploys a card issuance website from where users can download your spiffy new card. Note that by default access to the site is windows authentication based. Once the website is deployed you can customize it with your organization's name, logo, contact information, etc.

Tips

A subset of the settings that are part of the card file your users will download is derived directly from the STS settings. However to give the administrator more control over the process, changes to the STS that affect the card will not be applied to the card until the administrator chooses to do so and clicks the “Update Information Card” action.

The “Geneva” Server Beta 2 gives you a powerful new way to configure and maintain your configuration: PowerShell. I’d like to briefly note that there is a resource dedicated to configuring card issuance: GSInformationCard. There are five different cmdlets/verbs associated with this resource:

· Get-GSInformationCard,

· Set-GSInformationCard,

· Enable-GSInformationCard,

· Disable-GSInformationCard

· Update-GSInformationCard.

The GSInformationCard resource covers all UI capability and some additional parameters not visible in the UI, like explicitly adding claims and in depth management of certificate backed cards amongst others. Look to future posts for more details.

Conclusion

As you can see, “Geneva” Server provides quick access to the world of information cards:

· Simple, secure provisioning of cards to users

· Simple administration of the card

· Flexibility to provide/ensure specific authentication types

· Customizable site to provide users with familiar corporate site experience

A great reference for setting up information card issuance you can find here: http://technet.microsoft.com/en-us/library/dd807042(WS.10).aspx. And in the next post you are going to learn about a powerful feature build on top of card provisioning: silent card provisioning.

Veneta Tashev

Software Development Engineer in Test

“Geneva” Server Team

Identity Developer Training Kit – Featuring Geneva Framework Beta-2 and other identity products

CardSpaceBlog — Mon, 18 May 2009 23:10:00 GMT

With all the new “Geneva” Beta 2 products introduced at TechEd you may wonder how long it is going to take you to learn these new technologies. Well, the DPE team and the Geneva team thought about this and are happy to offer a developer focused training package, introduced as part of Geneva Framework Beta-2, named as “Identity Developer Training Kit (May 2009)”. This is a training kit for ASP.NET and WCF Developers intended to help them learn about how to build an end-to-end identity related scenario using Microsoft’s latest identity and access control developer products.

This kit contains a set of hands-on-labs, documents, and reference materials and covers the following products:

· Microsoft “Geneva” Framework Beta 2

· Microsoft “Geneva” Server Beta 2

· .Net Access Control Service (March CTP)

· Microsoft Federation Gateway

You can download the identity developer training kit (May 2009) here.

Also, here are links from Vitorrio's blog of the annoucement of availability of these kits, as well as more details.

If you are an ASP.NET developer be sure to check out the “WebSitesAndIdentity” lab which covers various exercises such as how to claims enable an existing ASP.NET application, federating with Geneva Server and LiveID STS from an ASP.NET application, and how to make use of Identity Delegation in an ASP.NET application. If you are a WCF developer be sure to check out the “WebServicesAndIdentity” lab which provides exercises for making your WCF service claims-enable and connecting it with an STS and then adding identity delegation capability to it. There are aspects of Access Control Service covered in this kit as well!

In addition, if you are looking for a site that is full of identity related videos, stop-by at “The Id Element” site – the one-stop shop for all things identity on Channel9. You can watch videos that cover the “what’s new in Beta 2” and deep dive of specific topics on identity products. These are videos covering interviews with the product team members who build these products and would wow you!

Enjoy coding!

What’s New in Geneva Beta 2

CardSpaceBlog — Tue, 12 May 2009 02:52:00 GMT

As announced at TechEd, Geneva has just released its Beta 2 bits! These are now available for download from here.

There is a lot that is new and updated in Beta 2! Here is a list of some of the things that you will be able to try out and give us feedback on. For additional details on each of these and more, see the release notes included with the Beta 2 package.

“Geneva” Server

· New rules engine for authoring claims transformation policies

· Ability to read attributes from AD, AD LDS, and SQL out of the box, plus pluggable provider model to enable access to other attributes stores

· Group policy-based Information Card provisioning for CardSpace “Geneva” clients

· Support for SAML 2.0 SP-Lite

· Proxy to enable authentication for users on the Internet when Geneva Server is on the intranet

· Scale out via farm and load balancer topology

· Powershell commandlets

· Support for AD RMS

· Utility for federating with the Microsoft Federation Gateway

“Geneva” Framework – IDFX

· Enhanced FedUtil Tool with local STS for easy offline development

· New Visual Studio templates for building claims-aware web applications, web services, and security token services

· Support for SharePoint 2007

· Revised token handlers

· Revised federation authentication module

· New Claims Authorization Manager API

· Updated config support

CardSpace

· Support for Group Policy-based Information Card provisioning.

· Updated management UI

· Updated card tile

· Group Policy-based way for administrator to make card selection decisions for specific sites

Improved provisioning of X509-backed cards
Compatible with most existing managed cards

We are very excited to be able to deliver these bits to you, and to hear your feedback. Please send any technical questions about Geneva to the product team via our forum or support email address. We will continue to announce updates to Geneva on our website and here on our team blog.