“Geneva” Team Blog : Geneva

Announcing WIF support for Windows Server 2003 !!

CardSpaceBlog — Fri, 18 Dec 2009 16:48:00 GMT

We are glad to announce that Windows Identity Foundation (WIF) RTW for Windows Server 2003 is available NOW! This release supports both Windows Server 2003 SP2 and Windows Server 2003 R2 platforms and following seven languages: English (en-us), German (de-DE), Spanish (es-ES), French (fr-FR), Italian (it-IT), Dutch (nl-NL), and Japanese (ja-JP).

You can download the language specific WIF RTW packages for Windows Server 2003 from here.

If you are looking WIF packages for following operating systems check out here.

· Windows 7

· Windows Server 2008 R2

· Windows Server 2008 SP2

· Windows Vista SP2

Windows Identity Foundation (WIF) RTM announced !!

CardSpaceBlog — Wed, 18 Nov 2009 18:21:00 GMT

We are very glad to announce that Windows Identity Foundation (WIF) has shipped! The official announcement of WIF RTM is made by Bob Muglia yesterday in his Keynote speech at PDC’09 Conference in Los Angeles. We are very excited to make this announcement at PDC’09 aligning with many other key product announcements made in PDC’09. It is our pleasure to offer you a claims-based identity foundation that is built using standards and that addresses the valuable beta feedback comments that you have provided to us in the past year.

We are happy to announce that in addition to English (en-us) language WIF is also available for six other languages namely, German (de-de), Spanish (es-es), French (fr-fr), Italian (it-it), Dutch (nl-nl), and Japanese (ja-jp).

Start building your production applications with WIF and leverage its extensibility points to achieve following major, but not limited to, value adds:

- standards-based and interoperable identity solution

- single claims-based identity model

- identity flow across on-premise and cloud applications

- federation capability

WIF Setup packages can be downloaded from here.

Watch the Channel-9 video with the core team who were behind the making of WIF and a short video on the impression of WIF RTM from our Director of Program Management, Conrad Bayer.

Check out the following resources to learn more about WIF:

WIF Whitepaper For Developers – by Keith Brown & Sesha Mani
Changes between WIF Beta-2 and RTW – by WIF Team
WIF Product Documentation on MSDN – by WIF User Assistance Team
A guide to claims-based identity – by Patterns & Practices Team (Preliminary draft)
New release of the Identity Developer Training Kit, updated for RTM and containing brand-new labs (WIF and Windows Azure, the new Access Control Service) – by DPE
A new channel9 training course dedicated to Identity developers, containing hosted versions of the labs in the kit and new introductory videos – by DPE
End to end sample FabrikamShipping, updated for the RTM release – by DPE
Sample ASP.NET controls (Claims-Driven Modifier Control and Security Token Visualizer Control) updated for WIF RTM – by DPE
Recordings of the identity sessions at PDC09 – by DPE
Update on Windows Azure + Windows Identity Foundation – by DPE

Claims-based identity is the next wave in identity and get onboard with Windows Identity Foundation (WIF) today!

Announcing Windows Identity Foundation (WIF) Release Candidate

CardSpaceBlog — Fri, 06 Nov 2009 22:32:00 GMT

We are happy to announce that Release Candidate (RC) of Windows Identity Foundation (previously known as Geneva Framework) is available NOW!

It comes with lots of great new features and with comprehensive set of samples in the WIF SDK.

This release contains major updates and new features such as:

· Refactored WSTrustClient as WSTrustChannelFactory and WSTrustChannel

· Extended tracing functionality for better diagnosibility

· Unifying SAML end points through WrappedTokenAuthenticator

· Crypto agility

· Bootstrap tokens availability through ClaimsIdentity

· Security token cache updates to support session mode for ASP.NET cookies

· FedUtil leveraged for control-based applications

We have heard your valuable feedback and have made changes to some of the features existed in Beta-2. Refer to the Changes Between Beta-2 and RC whitepaper for the list of major changes made in this RC. Also, the updated WIF Whitepaper provides you a conceptual overview on WIF features and scenarios.

You can get the WIF RC Setup packages here.

This RC is targeted for Win7, W2K8 R2, W2K8, and Vista platforms for both 32-bit and 64-bit architecture. Note that this release does not have W2K3 platform support, which will come later.

Move onto WIF RC and extend the great new WIF features!

How Windows Identity Foundation helps with access control and what is its relationship to AzMan

CardSpaceBlog — Tue, 20 Oct 2009 19:40:00 GMT

The new Identity and Access products wave from Microsoft brings a new, claims-based, approach to identity and access space. This new approach is based on the principles defined by the Identity Meta-System. Windows Identity Foundation (WIF), which is part of this new Identity and Access products wave, gives applications a much richer and flexible way to deal with identities by introducing claims-based identity concept. WIF also decouples the application business logic from the authentication and identity attributes lookup details by externalizing these processes into a component called security token service (STS). The primary goal of this new Identity and Access products wave is to enable this new, claims-based, identity and access model and make it as easy as possible for existing and new applications to leverage the exciting capabilities that this model provides.

One of the most important aspects of every identity and access platform is to enable applications to protect their resources from unauthorized use. Given the richness and flexibility that the claims-based identity model allows, it is even more important than ever to provide a guidance and model that allows applications to deal with claims-based identities with respect to controlling access to their resources. For this purpose, the WIF provides a new API that allows applications to deal with authorization related activities. This new API is centered around ClaimsAuthorizationManager class. The primary goal of this API is the same as of Authorization Manager, a component of Windows operating system, sometimes referred to as AzMan – to allow applications externalize the details of the access control management and authorization policies evaluation from their application logic. The API is completely .NET based, eliminating a need for managed layer wrappers to access a native API from the .NET applications. The API provides similar functionality to what AzMan AccessCheck API represents. However, there are important differences between the API that AzMan provides and the new ClaimsAuthorizationManager methods. As already mentioned, unlike AzMan, the ClaimsAuthorizationManager is purely .NET API making it easier to understand and use than managed wrappers around COM+ API that AzMan provides. But the biggest difference is that fact that AzMan is tied to a particular authorization policy format, does not natively support claims-based identities and its decision engine is fixed. In contrast, ClaimsAuthorizationManager directly leverages the claims-based identity concept and allows different implementations to be plugged behind its uniform authorization interface, as explained more below.

Given the flexibility and richness of the claims-based identity model, there is no single model for managing access to resources that would fit all the needs and scenarios enabled by the claims-based architecture. Because of this, the ClaimsAuthorizationManager, unlike AzMan, is not tied to a particular authorization policy implementation. Instead, the ClaimsAuthorizationManager serves as a framework into which various authorization policy implementations can be plugged in. This allows the developers and IT administrators to choose the right authorization policy mechanism for the given deployment and even replace the authorization policy implementation with a new one without affecting existing applications.

However, given the focus of the new Identity and Access products wave on enabling the claims-based access to applications and providing the necessary infrastructure to allow the authentication to be externalized from the applications, the WIF does not provide an authorization policy plug-in for the ClaimsAuthorizationManager. This means that, even though the authorization API is delivered and available through WIF, it cannot be used by applications at runtime without providing a concrete implementation of the authorization policy plug-in. From this perspective, the ClaimsAuthorizationManager, unlike AzMan, is not a complete out of the box authorization solution.

One of our goals, after we deliver this new Identity and Access products wave, is to explore one or more such authorization policy plug-ins that will integrate with the ClaimsAuthorizationManager API provided by WIF and allow the claims-based identity architecture to be fully leveraged when making access control decisions while being interoperable and based on industry best practices. Such authorization plug-in implementation together with ClaimsAuthorizationManager API in WIF can be thought of as a next generation of AzMan that is completely based on the Identity Meta-System principles.

With all all said, we encourage all developers that use or plan to use Windows Identity Foundation in their projects to leverage the new authorization API provided by the ClaimsAuthorizationManager class by moving their authorization logic from the application logic into a concrete implementation of the ClaimsAuthorizationManager that can then be used whenever an authorization decision needs to be made as part of the application’s business logic. By doing so, your application will allow the authorization logic to be externalized from the business logic and thus simplifying the application implementation. In the end this will give the users and administrators of the application sufficient flexibility to be able to change the underlying authorization logic based on their needs and provide the necessary foundation to enable the central management of authorization policies across the enterprise.

AD FS v2.0 Passes Liberty Alliance SAML 2.0 Interoperability Testing

CardSpaceBlog — Thu, 01 Oct 2009 02:48:00 GMT

Interoperability of identity systems is an important consideration for a large percentage of customers. With this in mind we chose to participate in 8 weeks of SAML 2.0 testing, which is was conducted by the Drummond Group Inc. As previously announced, we entered testing with three profiles, IdP Lite, SP Lite and EGov 1.5.

Today the test results were made public , and we are thrilled to announce we have passed. We are very proud of this accomplishment, and all the hard work the AD FS team did to make this happen.

We would like to thank the other test participants; Entrust, IBM, Novell, Ping Identity, SAP, and Siemens. They where all great to work with, and demonstrated a real commitment to ensuring all of our products work together for customers.

Testing was done in a full matrix, meaning all tests pass with each vendor. This meant 8 to 12 tests (depending on the profile) with each of the 7 solutions, with AD FS acting as both IdP and SP; resulting in about 150 tests to pass! As you can imagine there were a few nights the team didn’t get much sleep. If you would like to dig into the details of what was tested, the test plan is available from the Liberty site.

Additional articles about the Liberty Alliance Testing:

· PRN Newswire - Entrust, IBM, Microsoft, Novell, Ping Identity, SAP and Siemens Pass Liberty Alliance SAML 2.0 Interoperability Testing

· Computerworld - Microsoft passes its first SAML 2.0 interoperability test

CardSpace Geneva Beta 2 Samples Package

CardSpaceBlog — Tue, 28 Jul 2009 21:08:00 GMT

With the release of Beta 2 comes a set of samples specifically targeted towards CardSpace developers. Whether you are a web developer or a C++ programmer, you are sure to learn something new in our CardSpace Geneva Beta 2 Samples.

The samples pack covers three broad areas:

· A series of incremental web page samples showing how to invoke CardSpace, culminating in a sample that shows error handling and progress spinners for long-running operations like policy and token retrieval.

· A sample that shows using Geneva Framework’s WSFederationAuthenticationModule to protect a web site with CardSpace credentials.

· A sample for VC++ programmers that demonstrates CardSpace’s API for native programs. If you have wanted to include the CardTile in your own program or browser extension, this is for you!

To install the samples, just unzip them and follow the instructions in the included readme file. Enjoy! If you have any feedback, please share it in the forums.

Official Name for "Geneva"

CardSpaceBlog — Wed, 22 Jul 2009 02:55:00 GMT

This Monday, Microsoft made several announcements at the Worldwide Partner Conference in New Orleans. Among these announcements were the official names for the Geneva products currently in Beta.

The three components of Microsoft “Geneva” have the following names:

· Active Directory Federation Services – formerly known as “Geneva” Server. Active Directory Federation Services (AD FS) enables Active Directory to be an identity provider in the claims based access platform. AD FS provides end users a single sign-on experience across applications, platforms and organizations and simplifies identity management for IT Pros by reducing duplicate accounts.

· Windows Identity Foundation – formerly known as “Geneva” Framework. Windows Identity Foundation (WIF) offers sets of APIs for ASP.NET and WCF developers to build claims-aware applications and make them federation capable. This API set covers both building relying party applications and federation services that can issue security tokens.

· Windows CardSpace – same as current version. Windows CardSpace enables managed and native applications to participate in the claims-based access platform. Windows CardSpace empowers end-users to have better control of their identity and allows administrators to setup streamlined single sign-on access.

This news is part of our Business Ready Security strategy to help both partners and customers 1) protect everywhere and access anywhere, 2) integrate and extend security across the enterprise, and 3) simplify the security experience and manage compliance.

For more information about these announcements and others that were made, check out the Microsoft Forefront Team Blog.

Silent Information Card Provisioning

CardSpaceBlog — Mon, 15 Jun 2009 20:51:00 GMT

One obstacle that administrators looking to deploy information cards in an enterprise will inevitably face is getting information cards to their users. Nobody wants to have to send an email to their users saying that in order to access a web service, they’ll need to go to an issuance website and download an information card. Things should just work. With that in mind, the “Geneva” Server and CardSpace teams created Silent Card Provisioning, a feature that uses Group Policy to deploy information cards to domain users automatically.

Step by Step

Setting up Silent Card Provisioning is very simple. In the “Geneva” Server UI, select your information card and choose “Save Group Policy Template Files.” This will save group policy files called IdentitySelectorBaseGPTemplate and AutoCardProvisioningGPTemplate. The .adm versions of these files are needed for Windows Server 2003 domain controllers, while the .admx and .adml are for use in Windows Server 2008. For more details and a step-by-step guide to setting up silent card provisioning, see this link.

“Geneva” Server creates the necessary group policy templates for you.

Once the group policy is set on the domain controller, domain users with CardSpace “Geneva” will automatically connect to the server, download and install the card. This process happens silently and the user doesn’t have to know or worry about it. If anything about the card, such as the image or authentication types, is changed on the Server, CardSpace will automatically pick up those changes. If the card is disabled on the Server, CardSpace will delete it from client machines. This means that once CardSpace is installed, the user doesn’t have to do anything to get the cards they need.

Tips and tricks

· This feature integrates well with Card Usage Policy. By setting a card to be silently provisioned and automatically used, administrators can really streamline their user experience.

· The group policy template files specify the location of the Geneva Server, the issuer name, and the time interval to check for card updates. This interval is set to two days by default but can be made longer or shorter if necessary. In addition to updating at this interval, users will have their cards updated each time they log on.

· The easiest way to ensure that a client machine gets its group policy and cards updated right away is to log off and log back on. For testing, the following commands run from an administrative command prompt will also update a client’s card(s):

o GpUpdate /force

o "%PROGRAMFILES%\Windows CardSpace\bin\CSHelper.exe" /provision

Hopefully this feature will streamline your experience with Geneva in the enterprise and we look forward to hearing your feedback.

Oren Melzer
Software Development Engineer
“Geneva” Team

Enterprise Policy for Zero-click Sign-in Using Information Cards

CardSpaceBlog — Tue, 09 Jun 2009 20:08:00 GMT

Reducing your login steps one click at a time

One of the major goals of CardSpace “Geneva” is to streamline the login process and make it as quick and easy to understand as possible. In the first beta, as Oren outlines in his post, by building the card selector within the Windows-integrated Credential UI dialog, we provide a minimalistic login interface that has a familiar feel among Windows users. Also, the CardTile web control that Colin describes here uses the card image to quickly show the user the state of their login. For Beta 2 we’ve taken this streamlining one step further by introducing a group policy-based Card Usage Policy feature, which allows an administrator to designate Information Cards for automatic submission. This new feature was designed to walk hand-in-hand with the new Automatic Card Provisioning feature.

How Jerry the domain administrator can pick out cards for his users automatically

Let’s suppose Jerry, a domain administrator at Contoso, has provisioned Contoso Kerberos backed Information Cards to all members of his domain. Jerry has also built a SharePoint site that employees can log into using their new Contoso cards. When users login for the first time, they will be prompted with the CardSpace selector. Normally, the selector is designed to help the user make informed decisions about how they use their issued identities. However, in this case the card selection decision has already been made by the Jerry the Administrator. The Card Usage Policy feature allows Jerry to set up a domain policy that directs the CardSpace clients on his domain to use the provisioned cards automatically at his SharePoint site. With the policy in place, when a user browses to Jerry’s application the CardTile login control automatically finds the Contoso provisioned card in the user’s store and displays that card’s image on the login page. The user notices that an identity has already been picked out for them; all they have to do is click once and they’re immediately logged in without being prompted with a card selector.

What constitutes a Card Usage Policy

The Card Usage Policy feature makes use of the new ic09:CardType element that was recently incorporated into to the OASIS Identity Metasystem Interoperability Specification Version 1.1. Any card that is issued with the new CardType element can be added to an automatic card selection policy. The CardType serves as a card classification mechanism and it is a URI (e.g. a GUID with urn:GUID: prefix.) The CardType is not unique to a specific Information Card and all cards that are issued from the same source or for the same purpose will typically share a common CardType. A Card Usage Policy is made up of a set of CardTypes. Each CardType can be associated with a list of target applications to which it can be used. Jerry uses the Windows Group Policy Editor snap-in to configure the card selection policy he wishes to have pushed to his domain joined users. For a step-by-step guide on how to do this, please see the section Configuring "Geneva" Server to Issue Information Cards in the Geneva Server SbS Guide.

Application patterns and hostname wildcards in a Card Usage Policy

A Card Usage Policy is mapped to a web application using an application pattern, which is in the simplest sense a subset of the full URL of the application’s login page. Jerry’s application login page is hosted at jerry.contoso.com/apps/sharepoint/Login.aspx, so to match his provisioned Information Cards to his application Jerry enters the host name “jerry.contoso.com”. Jerry can make his policy more specific by including the application path. For example, “jerry.contoso.com/apps” will match to all login pages hosted under the “apps” path. The path can be as specific or generic as Jerry wants, but it’s important to note that a card policy will apply to anything hosted under the path of a given application pattern. Jerry can also make the pattern more generic by replacing the leftmost dot delimited components of the hostname with wildcards. Let’s suppose Jerry’s colleague Amanda hosts a Contoso claims enabled application at amanda.contoso.com/reports/Login.aspx, and she wants to be included in Jerry’s Card Usage Policy. Jerry can include Amanda’s application by changing his application pattern to “*.contoso.com”. While handy, the application path wildcard comes with a few restrictions. It can only be included in the hostname portion of an application pattern, and the wildcard must always compose the leftmost piece of a dot delimited hostname. For example, patterns such as “www.*.contoso.com” or “*ntoso.com” will not work.

If you have any feedback or questions about the new Card Usage Policy feature, please check out the Geneva forum.

Andrew Lavers

Software Development Engineer in Test

CardSpace “Geneva”

Identity Developer Training Kit – Featuring Geneva Framework Beta-2 and other identity products

CardSpaceBlog — Mon, 18 May 2009 23:10:00 GMT

With all the new “Geneva” Beta 2 products introduced at TechEd you may wonder how long it is going to take you to learn these new technologies. Well, the DPE team and the Geneva team thought about this and are happy to offer a developer focused training package, introduced as part of Geneva Framework Beta-2, named as “Identity Developer Training Kit (May 2009)”. This is a training kit for ASP.NET and WCF Developers intended to help them learn about how to build an end-to-end identity related scenario using Microsoft’s latest identity and access control developer products.

This kit contains a set of hands-on-labs, documents, and reference materials and covers the following products:

· Microsoft “Geneva” Framework Beta 2

· Microsoft “Geneva” Server Beta 2

· .Net Access Control Service (March CTP)

· Microsoft Federation Gateway

You can download the identity developer training kit (May 2009) here.

Also, here are links from Vitorrio's blog of the annoucement of availability of these kits, as well as more details.

If you are an ASP.NET developer be sure to check out the “WebSitesAndIdentity” lab which covers various exercises such as how to claims enable an existing ASP.NET application, federating with Geneva Server and LiveID STS from an ASP.NET application, and how to make use of Identity Delegation in an ASP.NET application. If you are a WCF developer be sure to check out the “WebServicesAndIdentity” lab which provides exercises for making your WCF service claims-enable and connecting it with an STS and then adding identity delegation capability to it. There are aspects of Access Control Service covered in this kit as well!

In addition, if you are looking for a site that is full of identity related videos, stop-by at “The Id Element” site – the one-stop shop for all things identity on Channel9. You can watch videos that cover the “what’s new in Beta 2” and deep dive of specific topics on identity products. These are videos covering interviews with the product team members who build these products and would wow you!

Enjoy coding!

Step-By-Step Guides, Virtual Machines and "Geneva" Whitepapers

CardSpaceBlog — Fri, 15 May 2009 05:31:00 GMT

“Geneva” Step-by-Step Guides and Virtual Machines

The Step-by-Step guides and virtual machines that were used at the Tech Ed "Geneva" hands on labs and sessions are now available for download. You should find these helpful if you were unable to get to TechEd, missed the Geneva hands on lab sessions, or just want to be able to go through the material at your own pace. They are a great way to get your hands on and play with the Geneva technology.

You can download these materals from here.

“Geneva” Interop Whitepapers

Also available are our "Geneva" interop whitepapers. These cover:

"Geneva" and Sun OpenSSO

Interoperability between applications in heterogeneous technology environments is essential to successful collaboration between organizations today. Sun and Microsoft are taking interoperability to a new level by utilizing the SAML federation standard in both the Sun OpenSSO Enterprise federation solution and the forthcoming Microsoft “Geneva” Server federation solution.

By standardizing on SAML for federation, Sun and Microsoft enable organizations to deliver collaborative services with ease.

"Geneva" and Novell Access Manager

Despite remarkable gains in IT capabilities and collaboration, organizations continue to struggle with administrative complexity, workforce productivity, and data security. Many organizations support a large number of users—including employees, customers, partners, and suppliers—who seek access to a wide variety of applications and services. This can be particularly challenging in mixed-technology and multiple-domain environments where users are spread across technical and business boundaries.

Microsoft and Novell have come together to solve these challenges and boost cross-organizational collaboration. The two companies are building the interoperability bridges that enable customers to reduce complexity, enhance security, and decrease costs. This paper explains the need for standards-based identity federation, and the current and forthcoming solutions that improve the interoperability of mixed-technology directory environments.

The interop whitepapers can be downloaded from here.

Other “Geneva” Whitepapers

Additionally, for Beta 2 we've updated our "Geneva" Framework for Developers whitepaper and the "Geneva" Datasheet. You can download these papers from here.

What’s New in Geneva Beta 2

CardSpaceBlog — Tue, 12 May 2009 02:52:00 GMT

As announced at TechEd, Geneva has just released its Beta 2 bits! These are now available for download from here.

There is a lot that is new and updated in Beta 2! Here is a list of some of the things that you will be able to try out and give us feedback on. For additional details on each of these and more, see the release notes included with the Beta 2 package.

“Geneva” Server

· New rules engine for authoring claims transformation policies

· Ability to read attributes from AD, AD LDS, and SQL out of the box, plus pluggable provider model to enable access to other attributes stores

· Group policy-based Information Card provisioning for CardSpace “Geneva” clients

· Support for SAML 2.0 SP-Lite

· Proxy to enable authentication for users on the Internet when Geneva Server is on the intranet

· Scale out via farm and load balancer topology

· Powershell commandlets

· Support for AD RMS

· Utility for federating with the Microsoft Federation Gateway

“Geneva” Framework – IDFX

· Enhanced FedUtil Tool with local STS for easy offline development

· New Visual Studio templates for building claims-aware web applications, web services, and security token services

· Support for SharePoint 2007

· Revised token handlers

· Revised federation authentication module

· New Claims Authorization Manager API

· Updated config support

CardSpace

· Support for Group Policy-based Information Card provisioning.

· Updated management UI

· Updated card tile

· Group Policy-based way for administrator to make card selection decisions for specific sites

Improved provisioning of X509-backed cards
Compatible with most existing managed cards

We are very excited to be able to deliver these bits to you, and to hear your feedback. Please send any technical questions about Geneva to the product team via our forum or support email address. We will continue to announce updates to Geneva on our website and here on our team blog.

“Geneva” at RSA2009 and TechEd

CardSpaceBlog — Wed, 29 Apr 2009 23:21:00 GMT

For the last several months, the Geneva team (CardSpace, Framework, and Server) have all been heads down, working on getting our Beta 2 out the door. And now, we are finally in the home stretch!

Geneva featured in RSA2009 keynote

One recurring theme at this year’s RSA conference has been identity. In Microsoft’s “Moving Towards End to End Trust: A Collaborative Effort” keynote, Scott Charney spent significant time discussing identity. You can watch the presentation here. (from the “Tuesday, April 21” menu).

Scott explained that to achieve end to end trust, we need to provide a missing “trusted people” layer to the trusted stack. The identity metasystem (listen from 21:02) and the “Geneva” platform (listen from 26:31) play an important role to fill the gap.

Geneva will be at TechEd

TechEd is coming up very soon. May 11-15, 2009. And the Geneva team will be there! There will be many sessions talking about Geneva, including two Hands-On-Labs. For a list of sessions, click here. (key word: Geneva) Additionally, we will, of course, have a booth at the expo where you can come by and meet us, or ask us questions.

Please stop by and give us your feedback!

Geneva TAP (Technology Adoption Program) Status

We have been overwhelmed by the amount of enthusiasm and the number of the very compelling applications to join our TAP. It was a very difficult process to try to choose the right set of varied scenarios and customers to support. We wanted to try to cover as diverse a set of different usage scenarios and customers as our team could support. But now, I am happy to say that our TAP program is underway. In the coming months, the things we learn from how these customers are deploying and using Geneva should find their way into a set of best practices and templates that everyone will benefit from. Expect to hear more about this in coming months as these take shape.

The CardSpace "Geneva" Control Panel Applet

CardSpaceBlog — Thu, 11 Dec 2008 04:19:00 GMT

Hello! My name is Robert Zhu and I am a developer on the CardSpace team. Today, I'd like to invite you on a brief tour of the CardSpace Control Panel Applet. The Control Panel Applet deals with the management of your Information Cards. From this component, you will be able to view, modify, and delete any Information Card in your possession. In addition to managing Cards, the Control Panel Applet also provides the ability to reset card history (card history keeps track of the Relying Parties at which specific Information Cards were used and what information was released).

To try it out, follow the steps below:

1- Install the CardSpace “Geneva” Beta

2- Install any card from the test site

3- Launch the CardSpace Control Panel Applet from the Control panel:

Control Panel -> User Accounts -> Windows CardSpace “Geneva”

Once you double-click on the Windows CardSpace “Geneva” icon, you should see the Management Interface (below):

The main page shows a complete collection of your Information Cards. To select an Information Card, click on it, and a blue highlight box should appear around your selection. Hold down CTRL while clicking to select multiple cards, or use CTRL+A to select all cards. Once you have made your selection, you can delete the specified cards by clicking the “Delete Card” link on the right. If you have just added a new Information Card to your collection, pressing ‘F5’ will refresh the list of cards.

As mentioned before, the Control Panel Applet provides the ability to reset all card history. To do this, click the “Delete all card history” link on the top left of the Management Interface. As mentioned in Oren’s post regarding automatic submission of credentials (http://blogs.msdn.com/card/archive/2008/11/18/the-cardspace-geneva-selection-experience.aspx#9128068), CardSpace displays a matching card that has been previously used at the site on subsequent visits. This decision is made by inspecting the card history; thus, deleting the card history has the consequence of resetting all your previous Card/RP associations. Think of it like clearing your browser’s page history.

In the future, we will be adding more features to the Management UI. Thanks for reading and your feedback is extremely valuable!

Robert Zhu,

Software Design Engineer

CardSpace “Geneva”

Using the CardTile with “Geneva” Framework

CardSpaceBlog — Sat, 22 Nov 2008 04:42:00 GMT

In an earlier posts, Colin described how to handcraft a web page to implement the new CardTile feature of CardSpace “Geneva” and Oren points out a way to require user interaction during authentication. This post will now explain how the “Geneva” Framework makes implementing these features quick and easy.

The InformationCard Control

As mentioned in the introduction to the “Geneva” Framework, one of the biggest goals of the framework is to give developers the ability to build secure Relying Party (RP) websites with ease and still give them flexibility in website design. One way that we do this is with the InformationCard control. This new control allows developers to leverage the security of InformationCards on their web site with minimal effort while being able to customize its behavior and appearance so that it fits naturally into the site’s layout.

This post is going to focus on how to use the new CardSpace CardTile and how to require user interaction during authentication using the InformationCard control. We’ll go into greater detail on how to secure your site using this new control in a future post.

As a side note, implementing the CardTile with the InformationCard control will prevent card selectors that don’t support CardTile, such as previous versions of CardSpace, from being able to log users into the web site. We are currently investigating how this behavior should be changed for a future release.

Implementing the CardTile with the InformationCard Control

So you have the “Simple Web Application with Information Card SignIn” sample from the SDK up and running and you want to see how you can customize the appearance of the control. Using the CardTile is a great starting point. Colin’s post describes the need to modify the OBJECT tag by hand. If you’re using the InformationCard control that comes as part of the framework, all this will be automatically done for you.

To implement the CardTile, simply open the solution, view the Default.aspx from the CustomUserNameCardStsHostFactoryWebSite project, view the properties for the InformationCard control, and look for DisplayType property.

By default this is set to None. Change it to CardTile and you’re done! Or if you prefer to edit the source XHTML by hand, simply add the DisplayType=”CardTile” attributes to the InformationCard control as shown below.

<idfx:InformationCard ID="InformationCard1"

…

DisplayType="CardTile">

</idfx:InformationCard>

Save your changes, browse to the page in IE, and view the source code. You’ll see that the OBJECT tag has been generated to use the CardTile with the onclick event already wired for you. With one small change you’re taking advantage of the CardTile feature of CardSpace “Geneva”.

type="application/x-informationcard"

onclick="javascript:InfoCardOnClick();">

…

<param name="displayType"

value="CardTile" />

…

</object>

You can also change the default width and height of the CardTile by changing the DisplayTypeHeight and DisplayTypeWidth properties in VisualStudio.

Alternatively, if you choose to do this by editing the source XHTML, just add the DisplayTypeHeight and\or DisplayTypeWidth attributes to the control with the desired values.

<idfx:InformationCard ID="InformationCard1"

…

DisplayType="CardTile"

DisplayTypeHeight="40"

DisplayTypeWidth="60">

</idfx:InformationCard>

After the changes have been saved and you browse to your site, you’ll see the OBJECT tag is rendered with the values you specified.

type="application/x-informationcard"

onclick="javascript:InfoCardOnClick();">

…

<param name="displayType"

value="CardTile" />

<param name="height"

value="40" />

<param name="width"

value="60" />

</object>

Requiring User Interaction

As a web developer, you may see fit to have users manually authenticate every time they come to your site. This can be easily be implemented by enabling the RequireUserInteraction on the InformationCard control.

Still using the “Simple Web Application with Information Card SignIn” sample, in VisualStudio view properties of the InformationCard control and locate the RequireUserInteraction property. As shown below the default behavior is set to False. Change this to True and you’re ready to go.

To do this by editing the source XHTML, add the RequireUserInteraction attribute to the control.

<idfx:InformationCard ID="InformationCard1 "

…

RequireUserInteraction="True">

</idfx:InformationCard>

After you save your changes and visit the web site, you can see by the source HTML that the OBJECT tag now contains the requireUserInteraction parameter.

…

<param name="requireUserInteraction"

value="True" />

</object>

The “Geneva” Framework Makes Customizing Simple

As you can see the “Geneva” Framework allows developers to easily customize their website and take advantage of new card selector features like CardTile and RequireUserInteraction. Our goal is for web sites to be able to implement such features with as little effort possible.

Looking forward to your feedback!

Thank you,

Jason D. Shaw

Software Design Engineer in Test - “Geneva” Framework Team