Addison wesley understanding windows cardspace an introduction to the concepts and challenges of digital identities jan 2008 ISBN 0321496841 pdf

Praise for Understanding Windows CardSpace
“Windows CardSpace, and identity selectors like it for non-Windows platforms, will
quickly bring information cards to the forefront as the authentication mechanism of
choice for end-users—at last significantly reducing the pain and risks involved in
username and password authentication. Vittorio, Garrett, and Caleb are three really
super smart guys who know CardSpace and the underlying technologies and standards intimately. In this book, they provide the perfect amount of detail on the very
real risks of today’s application security models, followed by an overview of relevant
cryptography and WS* protocols, and then they dig right in to common scenarios for
deploying CardSpace while also explaining important underlying parts of the
CardSpace technology to help you understand what’s going on under the hood. If you
aren’t sure if CardSpace is right for your applications, you should read this book and
find out why. If you are planning to implement a CardSpace solution, you should
absolutely read every page of this book to gain insight into otherwise not well-documented information about the technology.”
—Michele Leroux Bustamante,
Chief Architect, IDesign and Microsoft Regional Director
“Identity management is a challenging and complex subject, involving traces of cryptography and network security along with a human element. Windows CardSpace
and this book both attempt—successfully—to unravel those complexities. Touching
on all the major points of CardSpace and identity management in general, this book
comprehensively explains the ‘what’ and the ‘how’ of this new Microsoft technology.”
—Greg Shields,
Resident Editor, Realtime Windows Server Community,
Contributing Editor, Redmond Magazine and MCP Magazine
“Learn about CardSpace from the people who built and influenced it!”
—Dominick Baier,
Security Consultant, thinktecture


“Chock full of useful, actionable information covering the ‘whys,’ ‘whats,’ and ‘hows’
of employing safer, easier-to-use, privacy-preserving digital identities. Insightful perspectives on topics, from cryptography and protocols to user interfaces and online
threats to businesses drivers, make this an essential resource!”

—Michael B. Jones,
Director of Identity Partnerships, Microsoft
“It’s one of the most serious problems facing anybody using the Internet. Simply put,
today’s digital world expects secure and user-centric applications to protect personal
information. The shift is clear in the demand to make the user the center of their digital universe. The question is, how do you build these kinds of applications? What are
the key components? Unfortunately, identity is often one of the most overlooked and
least understood aspects of any application design. Starting with the basics and building from there, this book helps answer these questions using comprehensive, practical
explanations and examples that address these very problems. It’s a must-read for application developers building any type of Internet-based application.”
—Thom Robbins,
Director .NET Framework Platform Marketing, Microsoft, Author


Understanding Windows CardSpace


Independent Technology Guides
David Chappell, Series Editor
The Independent Technology Guides offer serious technical descriptions of important
new software technologies of interest to enterprise developers and technical managers.
These books focus on how that technology works and what it can be used for, taking an
independent perspective rather than reflecting the position of any particular vendor. These
are ideal first books for developers with a wide range of backgrounds, the perfect place to
begin mastering a new area and laying a solid foundation for further study. They also go
into enough depth to enable technical managers to make good decisions without delving
too deeply into implementation details.
The books in this series cover a broad range of topics, from networking protocols to
development platforms, and are written by experts in the field. They have a fresh design
created to make learning a new technology easier. All titles in the series are guided by
the principle that, in order to use a technology well, you must first understand how and
why that technology works.

Titles in the Series
Brian Arkills, LDAP Directories Explained: An Introduction and Analysis,
0-201-78792-X
David Chappell, Understanding .NET, Second Edition, 0-321-19404-7
Eric Newcomer, Greg Lomow, Understanding SOA with Web Services,
0-321-18086-0
Eric Newcomer, Understanding Web Services: XML, WSDL, SOAP, and UDDI,
0-201-75081-3

For more information check out informit.com/aw


Understanding
Windows CardSpace
An Introduction to the Concepts
and Challenges of Digital Identities

Vittorio Bertocci
Garrett Serack
Caleb Baker

Upper Saddle River, NJ
New York
Cape Town

Toronto
Sydney

Boston

Montreal
Tokyo

Indianapolis
London

Singapore

San Francisco

Munich

Paris

Mexico City

Madrid


Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the
publisher was aware of a trademark claim, the designations have been printed with
initial capital letters or in all capitals.
The authors and publisher have taken care in the preparation of this book, but make
no expressed or implied warranty of any kind and assume no responsibility for errors
or omissions. No liability is assumed for incidental or consequential damages in connection with or arising out of the use of the information or programs contained herein.
The publisher offers excellent discounts on this book when ordered in quantity for
bulk purchases or special sales, which may include electronic versions and/or custom
covers and content particular to your business, training goals, marketing focus, and
branding interests. For more information, please contact:

U.S. Corporate and Government Sales
(800) 382-3419

For sales outside the United States please contact:
International Sales

Visit us on the web: www.informit.com/aw
Library of Congress Cataloging-in-Publication Data
Bertocci, Vittorio.
Understanding Windows CardSpace : an introduction to the concepts and challenges
of digital identities / Vittorio Bertocci, Garrett Serack, Caleb Baker.
p. cm.
Includes index.
ISBN 0-321-49684-1 (pbk. : alk. paper) 1. Windows CardSpace. 2. Computer
security. 3. Computer networks—Access control. 4. Identity theft—Prevention. 5.
Web services. I. Serack, Garrett. II. Baker, Caleb, 1974- III. Title.
QA76.9.A25B484 2008
005.8—dc22

2007044217
Copyright © 2008 Pearson Education, Inc.
All rights reserved. Printed in the United States of America. This publication is protected by copyright, and permission must be obtained from the publisher prior to any
prohibited reproduction, storage in a retrieval system, or transmission in any form or
by any means, electronic, mechanical, photocopying, recording, or likewise. For
information regarding permissions, write to:
Pearson Education, Inc
Rights and Contracts Department
501 Boylston Street, Suite 900
Boston, MA 02116
Fax (617) 671 3447

ISBN-13: 978-0-321-49684-3
ISBN-10: 0-321-49684-1
Text printed in the United States on recycled paper at R.R. Donnelley in
Crawfordsville, Indiana
First printing December 2007

Editor-in-Chief
Karen Gettman
Acquisitions Editor
Joan Murray
Senior Development Editor
Chris Zahn
Managing Editor
Gina Kanouse
Project Editor
Betsy Harris
Copy Editor
Keith Cline
Indexer
Erika Millen
Proofreader
Language Logistics, LLC
Technical Reviewers
Dominick Baier
Eric Ray
Greg Shields
Publishing Coordinator
Kim Boedigheimer
Cover Designer
Sandra Schroeder

Compositor
Bronkella Publishing


To our families


This page intentionally left blank


Contents
Foreword
Preface

Part I

xv
xviii

SETTING THE CONTEXT

1 THE PROBLEM

3

The Advent of Profitable Digital Crime
4
The Dawn of Cracking
5
The Vandalism and Bravado Era: Viruses and Worms 7

The Rush to Web 2.0 and Asset Virtualization
10
Malware and Identity Theft
16
A Business on the Rise
27
Passwords: Ascent and Decline
Ascent
Decline

29
29
33

The Babel of Cryptography
Cryptography: A Minimal Introduction
HTTP and HTTPS: The King Is Naked

36
38
46

ix


x

Contents

HTTPS, Authentication, and Digital Identity

The Babel

52
57

The Babel of Web User Interfaces

79

Summary

84

2 HINTS TOWARD A SOLUTION

87

A World Without a Center

89

The Seven Laws of Identity
User Control and Consent
Minimal Disclosure for a Constrained Use
Justifiable Parties
Directed Identity
Pluralism of Operators and Technologies
Human Integration
Consistent Experience Across Contexts

92
94
96
98
101
104
105
107

The Identity Metasystem
Some Definitions

110
112

Trust
Roles in the Identity Metasystem
Components of the Identity Metasystem
The Dance of Identity

115
116
122
130

WS-* Web Services Specifications: The Reification
of the Identity Metasystem
The WS-* Specifications
WS-* Implementation of the Identity Metasystem

136
138
156

Presenting Windows CardSpace

161

Summary

164


Contents

Part II

THE TECHNOLOGY

3 WINDOWS CARDSPACE

169

CardSpace Walkthroughs
From the User’s Perspective
From the Web Developer’s Perspective

169
170
173

Is CardSpace Just for Websites?

175

System Requirements

176

What CardSpace Provides
Consistent User Experience
Brokering Trusted Interactions

177
177
181

A Deeper Look at Information Cards
Card Types
Personal Information Cards
Managed Information Cards

184
187
188
196

Features of the CardSpace UI
Private Desktop
Disabling CardSpace

Relying Party Identification Page
Managed Card Import Page

204
204
206
207
208

Common CardSpace Management Tasks
Management Mode
Creating and Editing a Personal Card
Moving Cards Between Computers

210
211
212
214

User Experience Changes in .NET Framework 3.5
Simplified Use of Personal Cards
Simplify Import of Managed Cards
Better Communication to the User

218
219
220
220

Summary

221

xi


xii

Contents

4 CARDSPACE IMPLEMENTATION

223

Using CardSpace in the Browser
Understanding the Information Card Browser
Extension
How Are the Extension Properties Used?
Scripting CardSpace
Processing the Token
Accepting Personal Cards at a Website
Accepting Managed Cards at a Website
Auditing and Nonauditing IPs

224

Federation with CardSpace

248

CardSpace and Windows Communication
Foundation
Windows Communication Foundation
Adding CardSpace to WCF
Calling CardSpace from WCF
Decrypting the Token
Verifying the Token
Processing Claims
Additional Policy Options

252
252
255
256
258
260
260
261

CardSpace Without Web Services
Manage CardSpace
Import a CardSpace File
Get a Token from CardSpace
Get a Browser Token from CardSpace

262
264
264
264
267

Summary

268

224
228
232
238
243
244
246

5 GUIDANCE FOR A RELYING PARTY

269

Deciding to Be a Relying Party

270

Putting CardSpace to Work
Preparation
Database Changes
Examining the Authentication Experience

274
275
276
277

Contents

Developing the New Authentication Experience
Signing In
Handling the Unknown Card
Associating an Information Card with an Account
Creating a New Account
Recovering an Account
Prompting the User to Use Information Cards
Account Maintenance

278
285
286
288
288
291
294
297

Privacy and Liability

299

Summary

302

Part III

PRACTICAL CONSIDERATIONS

6 IDENTITY CONSUMERS

305

Common Misconceptions about Becoming an
Identity Provider

306

Criteria for Selecting an Identity Provider
Managed Cards Profiles
Identity Provider Qualifications

309
309
312

Relying on an IP
Benefits of Using an IP
Reaching an Agreement with the Identity Provider

315
316
318

Migration Issues

320

Summary

321

7 IDENTITY PROVIDERS

Uncovering the Rationale for Becoming an
Identity Provider
Managing Identities for Your Organization
Managing Identities Used by Other Organizations
Providing Claims-Based Services

323
324
325
327
331

xiii


xiv

Contents

Internet Commerce
Providing Strong Authentication to Relying Parties

333
333

What Does an Identity Provider Have to Offer?
Understanding Your Data
Identity Provider Reputation

334
335
336

Walking a Mile in the User’s Shoes
Roaming with Information Cards

338
340

An Organization’s Identity

341

Summary

342

Index

343

Foreword
As this book explains, the Internet was built without any way of
knowing who you are connecting to. This is now universally
recognized as an architectural flaw. It is as nonsensical as a
house without a door or plumbing. Attempts to compensate for
flaws in architecture usually turn out to be messy, expensive,
and unsatisfying. This has certainly been the case with the
missing identity layer of the Internet.
However, while it is fairly easy to get people to recognize the
flaws in the present system, getting the whole world to agree on
a new Internet identity architecture is a daunting task. It means a
lot of people with different backgrounds have to think hard
about some pretty deep issues and breach many of the usual
divides. It also means that the benefits of the new architecture
should be obvious and the road to progress clear.
This book succeeds on all these fronts. It will be obvious to all
who read it that it benefits from the experience of people intimately familiar with the problem space and passionate about
what they are doing.

xv


xvi

Foreword

It starts with an expansive explanation of current problems, dangers, and protective technologies. We get a tangible sense of the
fragility of today’s Internet when faced with increasingly professional criminal attackers and confused users.
Then the authors present the conceptual work that forms the

basis of a new architecture: the laws of identity and the Identity
Metasystem. The explanation includes a look at how the new
architecture can be realized through web services.
Next comes a detailed analysis and explanation of the part of
the Metasystem that puts users in control of their identities—the
“identity selector.” This includes a detailed explanation of how
Information Cards work to turn digital identities into “real” visual things. All three authors were involved in building and testing out the first identity selector—Windows CardSpace—and so
have deep knowledge of the issues.
The book becomes progressively more concrete, with good
examples, and will be helpful to implementers, teachers, and
students. But, because of its breadth, I think that the more technical policy makers will also benefit from the work, getting a
real sense for how digital identity atoms fit together into molecules.
I hope the chapter on the relying party will inspire people to
build websites that take full advantage of Information Cards to
deliver increased privacy and security.
Vittorio has a distinguished background in security matters and
put together many of the first big Information Card pilots. Caleb
was part of the CardSpace design team, responsible for ensuring
that it actually did what it was designed to do. Garrett was the
first to integrate Information Cards into products like IIS and
worked closely with developers to develop an understanding of
best practices.


Foreword

All three are passionate and charming people and have contributed substantively to the emergence of Information Card
technology and the Identity Metasystem.
Have fun with their book!
Kim Cameron

Chief Architect of Identity, Microsoft
October 29, 2007


xvii


Preface
In the past few years, identity has finally been receiving the attention it deservers.
With rampaging phishing and widespread cybercrime as the
forcing functions, the industry as a whole is reacting with a concerted effort to understand what the best practices are and is
getting there fast. We had the privilege of being among the first
people concretely working on one of the key efforts of the identity renaissance: Windows CardSpace.
Windows CardSpace is an expression of the new user-centered
approach to identity management. The new approach is poised
to solve many different problems of diverse natures: There are
technological considerations, such as offering better authentication mechanisms than passwords; usability considerations, such
as guaranteeing that the user has a clear understanding of what
is going on; and even social-science considerations about how
we can effectively leverage trust relationships and make obvious
to the common user the identity of the website being visited.
That is the reason why explaining Windows CardSpace in just a
few words is so challenging. Depending on your background


Preface

and your role, you will be interested in a different angle of the
story. We experienced this fact countless times in the past two
years: with customers and partners, at conferences, with the

press, with colleagues from other groups, and even with
spouses, trying to explain what was that super important thing
that kept us late at the office.
We believe that user-centered identity management has the potential to change for the better how everybody uses the Internet.
We also believe that the best way of reaping its benefits is to
develop a deep understanding of the approach, complemented
by hands-on knowledge of supporting technologies such as
Windows CardSpace. The book you are holding in your hands
has the goal of helping you to gain such insights.
We live in exciting times. The entire industry is moving toward a
common solution, with a true spirit of collaboration and a strong
will to do the right thing. The discussion is open to anybody
who wants to participate. We hope that you will join us!

Book Structure, Content, and Audiences
Windows CardSpace is part of a comprehensive solution, the
Identity Metasystem, which tries to provide a solution to many
security-related bad practices and widespread problems.
CardSpace is also a very flexible technology that can be successfully leveraged to address a wide range of different scenarios
and business needs. Finally, Windows CardSpace enables new
scenarios and radically new ways of dealing with known problems. Given the sheer breadth of the areas it touches, it comes
as no surprise that people of all positions and backgrounds are
interested in knowing more about it.
To address so many different aspects and such a diverse audience, we divided the book into three parts.

xix


xx

Preface

Part I: Setting the Context
The first part of this book introduces you to user-centered identity management, the model on which Windows CardSpace is
based. This part lays the foundation for understanding the context in which CardSpace is meant to operate and the problems it
has been designed to overcome. Architects, analysts, and even
strictly nontechnical folks will get the most from this part. There
are practically no assumptions of prior knowledge; the text introduces the necessary concepts and technologies as needed.
Note that in the first part CardSpace is barely mentioned because the focus is on the underlying models and considerations
that are purely platform-agnostic.
Chapter 1, “The Problem,” explores the problems with identity
management today. It explores how authentication technologies
evolved into the current practices, showing the historical reasons for current widespread problems. The chapter introduces
basic concepts such as Internet protocols, types of attacks, introductory cryptography, authentication technologies, and so on.
Chapter 2, “Hints Toward a Solution,” presents the current thinking about what the ideal authentication system would look like.
The seven laws of identity are described in great depth. The
Identity Metasystem is introduced, and its compliance with the
identity laws is explained in detail. This chapter also provides a
basic introduction to advanced web services and highlights how
the abstract concepts in the Identity Metasystem map to concrete features in the web services set of specifications.
By the end of Part I, you will have a comprehensive view of the
situation: what the problems are we are wrestling with, why
they are here, and how the Identity Metasystem can solve them.
You will also understand the role of Windows CardSpace in the
big picture.


Preface

Part II: The Technology

Part II focuses on Windows CardSpace from a technological
standpoint. It describes the technology, the elements and artifacts it entails, the operations and development practices, and
the most common usage scenarios. This part is for the developer
or whoever wants to have hands-on experience with Windows
CardSpace.
Chapter 3, “Windows CardSpace,” introduces the technology.
This includes the user experience, Information Cards and the
different card types, the private desktop, and the canonical usage scenario.
Chapter 4, “CardSpace Implementation,” describes the usage of
CardSpace in the most common scenarios. From the HTML
integration syntax to token manipulation, going though federation, integration with web services and CardSpace invocation
via native APIs, this chapter covers all the basic development
tasks.
Chapter 5, “Guidance for a Relying Party,” presents a detailed
example of a common scenario: enabling Personal Cards on an
ASP.NET website.

Part III: Practical Considerations
The last part of this book is devoted to design and business considerations that come in handy when architecting a solution
based on Windows CardSpace (or on user-centered identity
management technologies in general). The chapters in this part
will prove useful for architects and project managers. Business
decision makers and IT managers will probably be interested in
some of these considerations, too. Hints for developers are
spread throughout the text.

xxi


xxii

Preface

Chapter 6, “Identity Consumers,” presents some thoughts about
deciding to be or to use an identity provider. It also looks at
things from the viewpoint of being a relying party: for example,
the main effects on your business and operations of accepting
identities in form of tokens and from third parties, and the opportunities you want to take advantage of and the caveats you
want to avoid.
Chapter 7, “Identity Providers,” lists some considerations to
keep in mind when becoming an identity provider.

Conventions
This book follows the conventions of the Independent
Technology Guides series. Analysis sections appear in boxed
sidebars and give you added perspective on the issues and technologies being discussed. Also, margin notes are included
throughout the chapters summarizing or pointing out the most
important points.
Code-continuation characters are occasionally used in lines of
code when we’ve broken lines to fit the printed page. Lines broken by code-continuation arrows should be entered as one line
when programming.


Acknowledgments
The authors would like to thank David Chappell for believing in
the project from the very beginning and for hosting our book in
his prestigious series. The deep discussions we had about identity and how to explain its nuances were invaluable in helping
us communicate the most complex topics.
We would like to thank Kim Cameron for eliciting the dialog
that led to the Laws, the Identity Metasystem, and ultimately

Windows CardSpace. We could not have hoped for anybody
more appropriate for writing the foreword.
Many thanks to the Addison-Wesley production staff, who
steered, guided, and helped us with great professionalism and
infinite patience: Joan Murray, Chris Zahn, Curt Johnson, Betsy
Harris, and Emily Frey.
This book would have never been written if we hadn’t had
many enlightening conversations with our colleagues: among
others, Ruchi Bhargava, Rakesh Bilaney, Donovan Follette, Vijay
Gajjala, HongMei Ge, Andy Harjanto, Nicolo Isola, Mike Jones,
Rajeswari Malladi, Luke Melton, Arun Nanda, Mark Oluper,

xxiii


xxiv

Acknowledgments

Govind Ramanathan, Rich Randall, Chuck Reeves, Nigel
Watling, Hervey Wilson, and Steven Woodward.
We would like to thank our management for endorsing and
encouraging us in this endeavor: James Conard, Samuel
Devasahayam, Neil Hutson, Stuart Kwan, and Anand
Sivaramakichenane.
Many thanks to the reviewers; without their tireless efforts this
book would be much harder to understand: Chris Zahn,
Dominick Baier, Eric Ray, Greg Shields, and many others.
This book would have been very different without the experiences we shared with the many pioneers and the visionaries
among our customers and in the community that decided to

work with CardSpace in its early stages: Working side by side to
make the Metasystem work for their scenarios was an incredibly
insightful experience. We can’t name you all here, but when
you read these lines, you will know we are talking about you.
Thank you!
Vittorio would like to thank his wife Iwona Bialynicka-Birula for
her love, infinite patience, and infallible support and for helping
to break down those super long Italian sentences; his parents
and siblings (Luisa Costantini, Bartolomeo Bertocci, Mauro,
Franco, Marino, Cristina, Ulderico, Maria, Laura, Guido, Mira)
for doing so much for him and for their unconditional love; and
some of his professors at the Università di Genova, for teaching
him the pride of computer science: Egidio Astesiano, Gerardo
Costa, Leila DeFloriani, and Paola Magillo.
Caleb would like to thank Paula Schachtel who provided encouragement, support, understanding, and an endless supply of
baked beets as he hid out in the office on the weekends to work
on the book. Also he thanks his parents, sister, and brother (Tom,
Linda, Vicki, and Thomas) for all they have done throughout the