Browse by Tags

• .net 3.5
• CardSpace
• certificate chain
• https
• ie
• MIX08
• MySpace
• No SSL
• security
• SSL
• the Web
• WCF
• Windows Communication Foundation

• Hide svc extension from your REST services with the URLrewrite module for IIS7

  I am now focusing exclusively on identity & services, true, but certain news about former interests of mine are just too good not to share. While evangelizing the web capabilities of WCF introduced in the framework 3.5, one of the most recurring questions was about hiding the svc extension for WCF services. That makes a lot of sense, since ideally a good RESTful URI (whatever that really means) should not give away the technology that is used to handle the resource and should not change when the underlying technology does change. Thanks to IIS7 architecture, it is very easy to write a URLrewrite module that does just that: if you recall the Mix session about MySpace's use of WCF in their REST API, you'll remember that they did demonstrate this (sample code here ). Now you don't need to write that module for the ground up anymore: we just shipped the technical preview of the "official" URLrewrite module for IIS7 . Give it a spin, and thanks to the IIS crew for listening to the REST community! Read More... Posted Sunday, June 01, 2008 3:29 PM from Vibro.NET | 1 Comments Filed under: orcas, the Web, WCF, MySpace, Windows Communication Foundation, MIX08

• CardSpace Certificate Chain Validation Issue with Intermediate Certificates

  One problem with the original version of CardSpace was that it seemed to reject some legitimate SSL sites, but like all tricky bugs, it didn’t happen consistently enough to be caught in the first release. What was going on was that sometimes CardSpace couldn’t validate the intermediate certificates in the certificate chain because of a disconnect with the browser’s certificate store. If intermediate certificates aren’t installed on a user’s computer, most browsers use the certificate obtained from the site to reconstruct the whole chain and show the user they are at an SSL site. CardSpace, as it turns out, was not able to get the missing certificates. Since, this bug could make a legitimate site appear to be fraudulent in CardSpace and because the behavior is intermittent, it might be missed by a web developer adding support for Information Cards to their site. We asked the IE team and the maintainers of the browser add-on for Firefox to enable CardSpace to retrieve the correct certificate, and they did. The update to IE was included in the October 2007 IE Security Update and the updated Firefox add-on can be downloaded here (thanks Axel !). Implementers of other Identity Selectors should consider whether this issue is present in their code as well. I’ll hand off now to Shan to explain more details about the problem and the fix. Rob Franco Lead Program Manager CardSpace ======== Introduction – How the recipient certificate & its intermediates Read More... Posted Friday, March 21, 2008 2:46 AM from CardSpace: Behind The Code | 1 Comments Filed under: CardSpace, security, orcas, SSL, https, certificate chain

• CardSpace support for Oasis WS-SX standards

  The OASIS Web Services Secure Exchange (WS-SX) technical committee has published specifications for WS-Security extensions and policies to enable the trusted exchange of SOAP messages. Their effort resulted in the WS-SX specifications that include WS-Trust , WS-Security policy and WS-Secure conversation. This standardization of WS-Trust is good news. Gartner says that: OASIS's ratification of two key standards means that Web services security has finally reached a level of maturity acceptable to many enterprises. This is a positive development for vendors and customers alike. The ratification happened in March 2007 and support for these standards was one of the main changes included in the .NET Framework 3.5 release of CardSpace. Overview of new WS-Trust specification The OASIS WS-Trust is very similar to the one people have been using. The main differences are: 1. Returning the security token: a RequestSecurityTokenCollection element is used to return a security token in the final response. 2. SecondaryParameters: When a requestor inserts parameters into an RST request that come from a third party, for example a relying party policy, there is a potential for an attack. In the contributed request, both requestor RST parameters and third party RST parameters are mixed together as direct children of the wst:RequestSecurityToken element. This prevents an STS from differentiating between the RST parameters based on their source. Therefore, the STS trusts both kinds of RST parameters Read More... Posted Wednesday, November 21, 2007 10:40 PM from CardSpace: Behind The Code | 1 Comments Filed under: CardSpace, .net 3.5, orcas

• All the bits to employ CardSpace without an SSL certificate are now available

  Hi, my name is Tariq Sharif and I am a program manager in the CardSpace team. After we released CardSpace V1 we received feedback from hobbyists, early technology adapters and site owners that getting/setting up a SSL certificate is hard and it is not needed for some set of their scenario and that this is blocking them from accepting information cards on their sites. Based on this feedback, the feature team decided to remove this requirement for the .Net Framework 3.5 release. In order to invoke Cardspace from a page that does not have an SSL connection you need two updated components. First you will need to install an updated browser specific extension that will work at an HTTP site . You can download the IE extension from here or if you have IE7 you probably already have it as part of the October security update . Second you will need to install an updated version of Cardspace that does the right thing when a website, the relying party, does not have a certificate. Latest version of Cardspace can be downloaded as part of .Net Framework 3.5 . You can read more technical details about this new functionally here in this post that Ruchi made a couple of weeks ago. Please feel free to drop us any comments on this, as we are always looking for feedback to help us refine this emerging technology. Thanks, Tariq Sharif Program Manager Read More... Posted Friday, October 26, 2007 2:24 AM from CardSpace: Behind The Code | 1 Comments Filed under: CardSpace, .net 3.5, orcas, ie, SSL, https, No SSL

• How Identity Providers can show custom error messages in CardSpace

  Wouldn’t you like to show your users a custom error message instead of this generic one? Now you can with the latest .Net Framework 3.5 release (Beta 2 as of this blog). Your Identity Provider can simply return a SOAP fault and CardSpace will display the Fault Reason Text. This feature is great because it enables you to present the user with help and support information such as phone numbers or URLs. Your error message can now look like this: Your fault reason text can also be language specific. CardSpace will display the correct fault reason text based on the UI locale. Frequently Asked Questions What is the format of a SOAP message? < s:Envelope xmlns:a = " http://www.w3.org/2005/08/addressing " xmlns:s = " http://www.w3.org/2003/05/soap-envelope " > < s:Header > < a:Action s:mustUnderstand = " 1 " > http://www.w3.org/2005/08/addressing/soap/fault </ a:Action > </ s:Header > < s:Body > < s:Fault > < s:Code > < s:Value > s:Sender </ s:Value > </ s:Code > < s:Reason > < s:Text xml:lang = " en " > In English … </</ s:Text > < s:Text xml:lang = " es-ES " > In Spanish … </ s:Text > </ s:Reason > </ s:Fault > </ s:Body > </ s:Envelope > Note that this SOAP message must be secured just like a typical application message. That is, it must contain the necessary Security headers (with all the necessary signature and encryption requirements based on the binding). CardSpace Read More... Posted Thursday, October 04, 2007 1:47 PM from CardSpace: Behind The Code | 1 Comments Filed under: .net 3.5, orcas