Garrett Serack: Open Source Development at Microsoft : CardSpace

Binary File Formats for Word, Excel, PowerPoint

GarrettS — Fri, 18 Jan 2008 00:20:04 GMT

Brian Jones posted yesterday about the availability of the docs for the binary file formats of Office Applications.

... Microsoft indicated that the documentation of the Binary Formats has been available royalty-free [since 2006] under RAND-Z to anyone who requests it by sending an email to officeff@microsoft.com

Nevertheless, in response to requests for even easier access to the Binary Formats, Microsoft has agreed to remove any intermediate steps necessary to get the documentation, and will post it and make it directly available for a direct download on the Microsoft web site. Microsoft will also make the Binary Formats subject to its Open Specification Promise (see www.microsoft.com/interop/osp) by February 15, 2008.

Now, having the Binary Formats under the Open Specification Promise, is extremely exciting. The OSP itself:

Microsoft irrevocably promises not to assert any Microsoft Necessary Claims against you for making, using, selling, offering for sale, importing or distributing any implementation to the extent it conforms to a Covered Specification (“Covered Implementation”), subject to the following. This is a personal promise directly from Microsoft to you, and you acknowledge as a condition of benefiting from it that no Microsoft rights are received from suppliers, distributors, or otherwise in connection with this promise. If you file, maintain or voluntarily participate in a patent infringement lawsuit against a Microsoft implementation of such Covered Specification, then this personal promise does not apply with respect to any Covered Implementation of the same Covered Specification made or used by you. To clarify, “Microsoft Necessary Claims” are those claims of Microsoft-owned or Microsoft-controlled patents that are necessary to implement only the required portions of the Covered Specification that are described in detail and not merely referenced in such Specification. “Covered Specifications” are listed below.

This promise is not an assurance either (i) that any of Microsoft’s issued patent claims covers a Covered Implementation or are enforceable or (ii) that a Covered Implementation would not infringe patents or other intellectual property rights of any third party. No other rights except those expressly stated in this promise shall be deemed granted, waived or received by implication, exhaustion, estoppel, or otherwise.

My first introduction to the OSP was back when I was in the Federated Identity team. When .NET 3.0 came out (which included CardSpace), I was thrilled when I found out that the protocols ended up in the OSP, which meant that there would be far less blockers in getting CardSpace adopted.

Technorati Tags: office,file formats,CardSpace,Open Specification Promise,OSP

I hacked RSA!

GarrettS — Tue, 06 Feb 2007 21:10:00 GMT

I successfully hacked RSA, check out the details on my blog: http://www.fearthecowboy.com/2007/02/i-hacked-rsa.html

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

What is the “Master Key” that is used to create the key-pair and PPID?

GarrettS — Tue, 06 Feb 2007 21:08:00 GMT

I talk a bit about the Master Key created when you create a personal card in my post at http://www.fearthecowboy.com/2007/02/what-is-master-key-that-is-used-to.html

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

What happens when my laptop gets stolen

GarrettS — Wed, 31 Jan 2007 07:44:00 GMT

I explain how CardSpace is protected when your laptop gets swiped: http://www.fearthecowboy.com/2007/01/what-happens-when-my-laptop-gets-stolen.html

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

Me and my PPID: Can I rely on it?

GarrettS — Sun, 28 Jan 2007 23:32:00 GMT

Be sure to check out my post on my blog: http://www.fearthecowboy.com/2007/01/me-and-my-ppid-can-i-rely-on-it.html

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

New Windows CardSpace Sample: SimpleSTS

GarrettS — Mon, 21 Aug 2006 20:17:00 GMT

I've added a new Simple STS sample to the Windows CardSpace community website at : http://cardspace.netfx3.com/files/38/default.aspx .

This should let everyone start building managed card support with a proof-of-concept STS.

http://cardspace.netfx3.com/files/folders/samples-july-ctp/entry5204.aspx

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

New Sample: Decrypting a Security Token

GarrettS — Thu, 17 Aug 2006 19:18:00 GMT

You can find a new CardSpace sample that shows the nitty-gritty of decrypting a SecurityToken:

http://cardspace.netfx3.com/files/folders/samples-july-ctp/entry5152.aspx

This contains the code for a new Token class, (derived from TokenHelper) which exposes a few more features, to be discussed in the future.

Additonally, The decryption itself has been simplified, and can be done without .NET 3.0 (however, the authentication and verification still uses .NET 3.0 code )

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

Private Personal Identfiers: Adventures in privacy

GarrettS — Fri, 11 Aug 2006 03:46:00 GMT

I had the question recently asked of me:

When using an STS (Security Token Server), the PPID (PrivatePersonalIdentifier) is under the control of the STS. In other words, an STS has to take note of the RP (Relying Party) it is identifying for and generate an Information Card (with the appropriate PPID) so that this card can be exhanged and installed off-line by the subject. Is this correct ?

The answer of course is... "Look, shiny thing!"

Seriously though... let's clarify a few things:

Managed Cards (Information Cards provided by an Identity Provider) do not store the values for claims inside the card. (don't beleive me? look at the sample here). So first, no matter how many Relying Parties a card is used at, the Identity Provider only needs to issue one card to a particular user.

Next, it's completely optional for the Identity Provider to issue identities with the PPID claim (although, it's a good idea). And even when they do issue identities with a PPID claim, they can implement it however they wish--it doesn't have to be a unique value for each RP for each User (heck it doesn't even have to be a base-64 encoded whatever... you could use any value that you assert is unique in your STS). They can maintain a singular identity, and the individual RPs get the same PPID for the same person.

But even then, let's assume that the IP wants to be more proactive in guarding privacy, and they do want to issue a new PPID for each User at each RP site. Then, they either need to calculate this in a replicable fashion, and do that each time the User uses the card, or generate it randomly, and store that information.

Now, it's important to remember to use the PPID claim (or whatever claim the IP has decided will be unique to that user) in conjunction with the Issuer's public key-- this gives you the assurance that the PPID is unique in the context of that Issuer.

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

Fat32: My Old nemesis.

GarrettS — Fri, 11 Aug 2006 02:45:00 GMT

I've come across the same issue three times in the last two days, so it's bloggin' time!

CardSpace requires that the user's profile is on an NTFS drive. Currently, the problem you see if your profile is on FAT32, is that the CardSpace Identity selector won't come up, and you'll get something in the event log that looks like this:

The description for Event ID ( 102 ) in Source ( Microsoft.InfoCards.Diagnostics 3.0.0.0 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: The Windows CardSpace service cannot be started on this file system.,    at System.ServiceModel.Diagnostics.ExceptionUtility.TraceFailFast(String message, EventLogger logger)
   at System.ServiceModel.Diagnostics.ExceptionUtility.TraceFailFast(String message)
   at Microsoft.InfoCards.Diagnostics.DiagnosticUtility.FailFast(String message)
   at Microsoft.InfoCards.Diagnostics.InfoCardTrace.FailFast(String message)
   at Microsoft.InfoCards.InfoCardService.FailFastIfNoFileSystemSecurity()
   at Microsoft.InfoCards.InfoCardService..ctor()
   at wmain()
   at _wmainCRTStartup()

Which, once you know what the issue is, it's easy to guess the reason.

So, why doens't it work on FAT32? CardSpace ACL's the card store so that it's locked down quite tight, and even the user doesn't have access to the files. It's a security precaution to prevent tampering both by snoopy users and snoopy processes.

When CardSpace starts up, it checks the security of the card store, and if it's not appropriate, it refuses to continue.

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog:http://blogs.msdn.com/garretts

Creating managed Cards

GarrettS — Wed, 09 Aug 2006 00:43:00 GMT

Vittorio and I sat down and expanded his exploration on the managed card creation, and we came up with a Sample that details out what-you-need to know about creating managed Information Cards.

Check it out:

http://wcs.netfx3.com/files/folders/samples-july-ctp/entry4926.aspx

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog: http://blogs.msdn.com/garretts

Introduction to CardSpace with Internet Explorer 7.0 tutorial/sample posted

GarrettS — Wed, 09 Aug 2006 00:29:00 GMT

I've posted a July-CTP ready version of my Introdouction to CardSpace with Internet Explorer 7.0.

It's a fantastic primer on getting started with CardSpace, I hope you'll check it out;

http://wcs.netfx3.com/files/folders/samples-july-ctp/entry4898.aspx

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog: http://blogs.msdn.com/garretts

Where are the WS-* Protocols? (Part One)

GarrettS — Mon, 07 Aug 2006 18:06:00 GMT

Logging into a Website

When signing into a website using CardSpace, the website has the choice of accepting two card types, Personal Cards or Managed Cards.

Personal Cards are ones that you create the claim values yourself, support only a fixed set of claims, and have the cryptographic keys and PPID generated for you.

Managed Cards are cards that are issued to you from an Identity Provider, they decide the claims, and they provide the Security Token Server that issues the token to the webiste. We'll cover this one in Part Two.

Personal Cards and the Protocols

When a website requests a personal card, it does so by putting an object element into the HTML of the page, and engaging the CardSpace Identity Selector:

<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
  <title>Sample 4</title>
    <object type="application/x-informationcard" name="_xmlToken">
      <param name="tokenType" value="urn:oasis:names:tc:SAML:1.0:assertion" />
      <param name="issuer"
         value="http://schemas.microsoft.com/ws/2005/05/identity/issuer/self" />
      <param name="requiredClaims"
        value="http://schemas.microsoft.com/ws/2005/05/identity/claims/givenname
               http://schemas.microsoft.com/ws/2005/05/identity/claims/surname
               http://schemas.microsoft.com/ws/2005/05/identity/claims/emailaddress
              http://schemas.microsoft.com/ws/2005/05/identity/claims/privatepersonalidentifier" />
    </object>
  <script language="javascript">
      function GetIdentity()
      {
        var xmltkn=document.getElementById("_xmltoken");
        var thetextarea = document.getElementById("xmltoken");
        thetextarea.value = xmltkn.value ;
      }
  </script>
</head>
<body>
  <form id="form1" method="post" action="login4.aspx">
  <div>
    <button name="go" id="go" onclick="javascript:GetIdentity();">
       Click here to get the token.
    </button>
    <button type="submit">
       Click here to send the card to the server
    </button>
    <textarea cols=100 rows=20 id="xmltoken" name="xmlToken" ></textarea>
  </div>
  </form>

</body>
</html>

This obviously does not use any WS-* protocols, it's just simply asking the browser to supply the token requested to the website. And, with no STS in the puzzle, where's the WS-*?

Well, there is an STS. It's built into the CardSpace Identity Selector. It's there to provide the Personal card to the Relying Party (the website). The communication between the Identity Selector and the STS should be WS-* right? Well, since they are tightly coupled in this case, the STS in CardSpace short-circuits some of that and delivers the token to the browser just using inter-process communication. But the STS is built as if it was going to go over a wire, just optimized for local use.

So, there really isn't WS-* involved here. Until CardSpace supports a Portable STS, which then would seperate the Idenity store from the Idenity Selector, thus requiring WS-*.

g	Garrett Serack \| Program Manager \|Federated Identity Team \| Microsoft Corporation blog: http://blogs.msdn.com/garretts

Detecting Information Card Support (CardSpace!) in a browser

GarrettS — Sat, 05 Aug 2006 01:23:00 GMT

I hacked out this a few weeks back, and never got around to publishing it. I've not decided that this is the 'official' way to detect Information Card support in a browser, but it'll do until I can think of something better.

I'd say something like, "see how it detects support in other browsers too?" except that I'm not thinking many people have a CardSpace plugin for another browser yet. But you can trust me--It works!

<html>

<head>

function AreCardsSupported()

{

var IEVer = -1;

if (navigator.appName == 'Microsoft Internet Explorer')

if (new RegExp("MSIE ([0-9]{1,}[\.0-9]{0,})")

.exec(navigator.userAgent) != null)

IEVer = parseFloat( RegExp.$1 );

if( IEVer >= 6 )

{

var embed = document.createElement("object");

embed.setAttribute("type", "application/x-informationcard");

if( ""+embed.issuerPolicy != "undefined" )

return true;

return false;

}

if( IEVer < 0 && navigator.mimeTypes && navigator.mimeTypes.length)

{

x = navigator.mimeTypes['application/x-informationcard'];

if (x && x.enabledPlugin)

return true;

}

return false;

}

function ShowDetection()

{

if( AreCardsSupported() )

alert( "Information Cards are supported by this browser :D" );

else

alert( "Information Cards are NOT supported by this browser :(" );

}

</SCRIPT>

</body>

</head>

g	Garrett Serack \| Program Manager \| Connected Identity and Directory\| Microsoft Corporation blog: http://blogs.msdn.com/garretts