Windows CardSpace Martin Parry Developer Evangelist Microsoft

Event slides will be posted at:

Identity: problems Passwords too easy to crack Or too hard to remember I want multiple identities Results in identity silos Banks etc. would like to make sign-on data a lot more complex Users’ ability to remember is the obstacle Nobody trusts a single organization to store all identity information

Identity: a new approach Kim Cameron; Seven laws of identity We have interoperable WS-* specs Allow multiple identity systems to take part We have a standard format for credentials SAML tokens The Identity Metasystem

Security Tokens SAML Security Assertion Markup Language Prevailing format for credentials today What’s in a security token? Collection of claims (self-asserted or verifiable) Token signed by issuer Issuing a token Use WS-Security and WS-Trust Consuming a token Verify signature, decide if issuer trusted Read claims (for authZ decisions)

Example Security Token Given Name:Martin Family Name:Parry Martin Parry

Security Token Service Username/password X.509 Certificate Another security token Biometric Etc... Give it something... Martin Parry

Federation If users have accounts elsewhere and you trust the authN that takes place there Don’t add user accounts to your system Accept security tokens issued elsewhere Establish trust between systems WS-Federation Think of B2B scenarios

Federation: example Instead of provisioning a new user account for a partner, I’ll let her organization authenticate her Automate the trust relationship Ask user to supply a SAML token issued by a partner org SAML token contains claims about the user Partner org claims that this user’s name is Alice Partner org claims that Alice is a Purchaser Partner org claims that Alice is authorized to purchase bike parts Reduces identity management burden and latency

Information Cards Identities represented as cards Users understand that they need to be careful when giving out credit card details Self-issued “personal card” Created by user and held in local secure store Private personal identifier “Managed card” Issued by trusted Identity Provider Visible locally but identity information is stored at IP Cards do not contain security tokens They represent my ability to supply a token

How it works Policy 2. “I would like a SAML 1.1 token, containing First Name, Surname, issued by *any*” 3. UI filters cards that can satisfy policy 4. User picks a card 5. Token is requested 1.Access resource 6. Token is created 7. Token is presented Relying Party Identity Provider

Demo Create a self-issued card Sign on to a website using the card

HTML Click here to sign in <param name="requiredClaims" value=" nalidentifier" />

Server-side code protected void Page_Load(object sender, EventArgs e) { string xmlToken = Request.Params["xmlToken"]; if (xmlToken == null || xmlToken.Equals("")) ShowError("Token presented was null"); else { TokenHelper tokenHelper = new TokenHelper(xmlToken, " givenname.Text = tokenHelper.GetClaim(ClaimTypes.GivenName); surname.Text = tokenHelper.GetClaim(ClaimTypes.Surname); .Text = tokenHelper.GetClaim(ClaimTypes. ); } Clearly all the work’s in TokenHelper Get it in the samples at

How to implement a RP Update user database To include unique IDs from CardSpace Create an association page Users can associate cards with their accounts Update the sign-in page To allow the use of cards Can still allow other credentials Update registration page To allow the use of cards

Event slides will be posted at:

Get the latest technology previews, trial software, special offers Get information tailored to your needs Pick your RSS feeds Sign up for MSDN Connection at:

Resources, tools and betas Learn about development for Windows Live Useful resource for.NET Framework 3.0, the development platform for Windows Vista Get the latest betas for Windows Vista and Office Try Visual Studio Check out the free Express versions of Visual Studio Learn about and try the new Web and client designer tools Resources

Additional Information UK MSDN Events Post events page including slide decks Upcoming events UK MSDN Site & Flash Newsletter Local news, events, nuggets & webcasts Register to receive the bi-weekly MSDN Flash by