Windows CardSpace Team Bloggers

Zermatt & Cloud @ TechEd New Zealand/Australia

Vibro.NET — Wed, 06 Aug 2008 07:29:59 GMT

Well, it's almost one month since I wrote the last " useful " posts : you would not believe how incredibly busy I am on stuff I can't talk about just yet (but soon, very soon). In this quick update I am excited to report that I am going to speak at TechEd New Zealand & TechEd Australia ! As strange as it may sound, the 114 flights I've boarded since I moved to Corp (October 2005) never took me under the equatorial line; furthermore, it's since first grade that I'm told how cool it is that New Zealand is at the exact antipodes of Italy, has roughly a boot shape as well, etc... that's the farthest place from home I can travel to without leaving the planet :-) I am going to deliver 2 sessions , both in NZ and in AU: Identity & Cloud Services (Architecture track, level 300) The shift towards cloud computing is one of the major trends in today’s IT industry. As resources and assets are increasingly hosted off-premise, traditional strategies for access control and identity management are proving incapable of handling distributed scenarios and cross-boundary communication. This presentation briefly outlines how architectures relying on claims-based identity management, security tokens and open standards can address cloud computing scenarios with the same ease with which they can handle traditional ones. The identity capabilities of Biztalk Services will be featured as a concrete example of an application of the new paradigm. “Zermatt” Developer Framework: Putting Authentication...(read more)

How did you get started in software development?

Vibro.NET — Fri, 25 Jul 2008 02:32:00 GMT

[I suggest my usual readers to skip this post altogether, you won't find anything useful here :-)] Romeo tagged me with this "How did you get started in software development?" quest. I was already feeling guilty, because given how swamped I am I knew I was not going to have time to reply to the tag: OTOH right now my main PC is unusable, since I am repaving a new HD on it, hence while the network install goes I can write this up. How old were you when you started programming? A quale età hai cominciato a programmare? I was 12. One Christmas parents & siblings joined forces and got me a Commodore16 : it was just *fantastic*. How did you get started in programming? Come hai cominciato a programmare? With the reference manual of the basic 3.5. What was your first language? Qual’è stato il tuo primo linguaggio di programmazione? Basic, the one that came with the Commodore16. What was the first real program you wrote? Qual’è stato il primo programma vero che hai scritto? Hard to define "real" here. I would say that the first program I have wrote for a purpose different than pure enjoyment was a control routine for a Siemens PLC. It was for a shop class, we had those PLC working in AWL-step5. Not very structured, but hey... certainly software! What languages have you used since you started programming? Quali linguaggi hai usato da quando hai cominciato a programmare? Ah, hard to remember them all. Already mentioned Basic and AWL-Step5. At the University it was mainly Pascal, C and...(read more)

Interesting thing found at OSCON: Taint

Fear the Cowboy — Wed, 23 Jul 2008 21:24:00 GMT

I attended a session this morning called " PHP Taint Tool: It Ain't a Parser " by Luke Welling. Luke introduced a tool he's working on at OmniTI that is designed to assist in sniffing out where the potential for untrusted input is handled. From...(read more)

Hey, are you at OSCON?

Fear the Cowboy — Wed, 23 Jul 2008 18:42:00 GMT

This week I'm at OSCON in Portland, OR. I like what their site says about it: "OSCON is the crossroads of all things open source, bringing together the best, brightest, and most interesting people to explore what's new, and to champion the cause...(read more)

Blame it on your lying, cheating, cold dead-beating, two-timing, double-dealing mean mistreating, loving heart

Fear the Cowboy — Mon, 21 Jul 2008 19:56:00 GMT

Ever notice how folks who blog sporadically (uh, like me!) always apologize for not blogging for a while, and then re-affirm their dedication to blogging regularly? And often, accompanying their apology, is also a reason. I was going to " Blame it...(read more)

2 new great reviews for our book, and status after 1/2 year of availability

Vibro.NET — Mon, 21 Jul 2008 08:00:00 GMT

It's since April that I don't write about the book (at the time we released the entire Chapter 2 on MSDN ). Last week I received notice that 2 new reviews were published: one is from the Denver Visual Studio User Group , the other is on Paul Van Brenk's blog . Both reviews are extremely nice, for which we are very grateful; I especially like the fact that in both cases the reviewers perceived our intention to deal with the problem from an holistic point of view, regardless of our affiliation with a technology or another. Thank you guys! (update: I've just stumbled in another review I didn't know about, on (in)secure magazine issue 17 . Niiiiice). In fact, in the last months various illustrious figures mentioned our book as well: David Chappell , Drummond Reed and Francis Shanahan wrote extremely nice reviews I never mentioned here until now, while I did mention the first entries from Kim and Mike . Add that to the podcast on Perspectives , the interview on channel9 with Carlo & Caleb, the podcast on SearchWinDevelopment , the bonus chapter on codeproject , the extremely nice reviews on the Amazon US page ... and again, mentions from Neil Hutson , Alexander Strauss , Feliciano Intini , Mario Fontana , ... I am sure I am forgetting something (for which I apologize). And now that I begun to hang out at Identity conferences, I can't tell you how pleasant it is to have complete strangers zeroing on you and telling you all sorts of nice things :-) I guess I am easily recognizable...(read more)

Issuing smartcard backed managed cards... using Zermatt

Vibro.NET — Thu, 17 Jul 2008 21:30:00 GMT

We are back! I hope you had fun with the STS tutorial I posted yesterday night ; here we move a step further and examine how to equip our STS with managed card issuance logic & UI. As anticipated, this is going to be MUCH faster. If you recall, in the last post I asked you not to delete the Default.aspx page that the new web site template created for you: we are going to put our card issuance UI there. At thsi point the visual studio project should look as follows: The only new element I added is the information card image information-card.png, which will be used as the background of the information cards we'll issue. Of course nothing prevents you to get all fancy and allowing the user to upload an image for personalization purposes, but here we want to be quick & dirty (well, at least quick ;-)). The little image is below, for your viewing pleasure. Time to add some UI. Let's open Default.aspx inn the designer and let's drag some controls. <% @ Page Language ="C#" AutoEventWireup ="true" CodeFile ="Default.aspx.cs" Inherits ="_Default" %> <! DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> < html xmlns ="http://www.w3.org/1999/xhtml"> < head runat ="server"> < title > Untitled Page </ title > </ head > < body > < form id ="form1" runat ="server"> < div > Managed Card Generator < br /> < br /> Card name: < asp : TextBox ID ="txtCardname"...(read more)

Setting up a quick & dirty STS which supports smartcard backed managed cards... using Zermatt

Vibro.NET — Thu, 17 Jul 2008 07:11:23 GMT

Just back from vacation. The tan barely started to fade, and here I am already playing with the new shiny toy :-). Did you experiment with Zermatt by now? As Kim mentions the samples (and the documentation) are an excellent way to start, and I am sure that blog posts & tutorials will soon start mushrooming here and there in the blogosphere: here I begin my humble contribution with my first technical post about Zermatt . I had *absolutely* no hesitations when deciding which scenario I should tackle first: an active STS which handles requests backed by smartcards . I received asks about from many segments (especially about eID management from governments and high authentication levels for finance) and pretty much from everywhere in the world (especially Europe and Asia): I am really delighted to finally have a chance to give you something about that scenario that you can compile in visual studio, as opposed to the usual whiteboard sketches :-) Before we dive into the code, let me disclaim the disclaimable: as usual, the code you see in this blog is just an example and is by no mean production ready code. My purpose here is to introduce you to new ideas, so I favor readability and clarity over completeness If you consider the definition of best practices as "A technique or methodology that, through experience and research, has proven to reliably lead to a desired result" , I think I can safely say that there are no established best practices yet. Sure, there are some fixed points...(read more)

John Fontana on Zermatt

Vibro.NET — Fri, 11 Jul 2008 19:25:24 GMT

I am sure you already saw Kim's post about John Fontana's interview with Stuart , appeared on Network World . I like how John communicates the importance of this release, and how it positions it in the context of the broader picture. Recommended reading :) Also, the blogosphere is buzzing: if you toy with your favorite feeds or search engines, you'll find many sources chiming in or even already playing with Zermatt ... that's the spirit! See you next week ;-) Read More......(read more)

Getting down with Zermatt

Kim Cameron's Identity Weblog — Thu, 10 Jul 2008 01:09:50 GMT

I found the samples very clear, and uncluttered with a lot of "sample decoration" Read More......(read more)

Key Piece of The Identity Puzzle

Kim Cameron's Identity Weblog — Wed, 09 Jul 2008 23:15:24 GMT

Microsoft has released a beta of its most important developer tool to date Read More......(read more)

Problem between keyboard and seat

Kim Cameron's Identity Weblog — Wed, 09 Jul 2008 22:43:17 GMT

Well, when you switch off all security mechanism then, yes, there are security flaws... Read More......(read more)

Announcing the Beta release of “Zermatt” Developer Identity Framework

Vibro.NET — Wed, 09 Jul 2008 17:58:04 GMT

Ahh, I’ve been looking forward for this post for a looong time. We just made available for download the bits of the Beta of “Zermatt” Developer Identity Framework . “ Zermatt ” is the codename of a .NET framework that helps developers build claims-aware applications to address challenging application security requirements using a simplified application access model. Let me expand a bit on that. If you want to develop applications that take advantage of claims & identity Metasystem goodness in general, Zermatt makes your life easier by providing base classes, controls but especially capabilities & a programming model that take care of most of the plumbing for you. Regardless of the role (IP, RP, subject) or the style (Active, Passive, “ Passive-Aggressive ”), Zermatt shields you from the sheer handling of protocols & tokens and provides you with a great model for externalizing your access logic. For my loyal readers and in general to whoever worked with tokens and cardspace in general, who stormed me with mails since the TechEd EMEA demo and even earlier: this means that we can finally retire historical samples like the SimpleSTS and the TokenProcessor class . Zermatt is a fully supported developer framework that gives you those capabilities and MUCH more. How much more? Below there’s a partial list of the goodies you get: · An HttpModule (the Federated Access Module, or FAM) that takes care of handling the token processing pipeline: fully extensible & web.config-urable,...(read more)

Digital Identity Podcast for MySuccessGateway

Mike Jones: self-issued » Windows CardSpace — Fri, 04 Jul 2008 07:32:17 GMT

Kim Cameron and I recorded a podcast on digital identity for MySuccessGateway this week at the invitation of Jim Peake of SpeechRep Consulting. Jim was a gracious, informed, and enthusiastic host during our conversation, which covered a wide range of digital identity topics including identity theft, shared secrets, privacy, Information Cards and the Information [...] Read More......(read more)

CardSpace Consumer Website

Mike Jones: self-issued » Windows CardSpace — Fri, 04 Jul 2008 05:56:31 GMT

Microsoft recently created a Consumer Website for CardSpace to educate end-users about Windows CardSpace and Information Cards. This complements the developer-focused information at the MSDN CardSpace site and the CardSpace Community Site. No, it’s not the kind of content targeted at regular readers of this blog – especially the short video – but then, that’s [...] Read More......(read more)