do it. think it. blog it! ... a twisted world

My ongoing effort to develop a infocard authentication module... (which will be published here)

Step 1: Install Internet Explorer 7.0 (Beta 2). This UNFORTUNATELY works ONLY with Internet Explorer 7.0. Well, I'm really not too sure if "fortunately" or "unfortunately" would be the appropriate word to be used... but anyways...

Step 2: get infocard up and running on your desktop's. ( using the WinFX CTP ) refer to my prior post. There may be better and more ways of installing the infocard component on one's desktop, But I'm aware of just this method for now. If you know of other methods, please post them as comments here.

Step 3: Enable SSL on your web application. ( refer to your webserver docs to learn how to do it ) The login requires an SSL connection. InfoCard will use this certificate to (1) display the trust dialog for first time visit (2) encrypt the token to the targetUrl. InfoCard supposedly also supports High Assurance certificate. NOTE : You may be also able to use Paul Johnston's client side Javascript Hash Algorithm, but I've not tested it and am not sure.

Step 4: get your web application to invoke the infocard component Identity Selector to enable you to choose the credentials you would like to submit. The Web Application can simply embed HTML tags using either the OBJECT tag ot the XHTML tag as part of the FORM element. The following code snippet would enable you to do that: ( just an example based on the web application requiring only the Email Address of the authentication source )

click to enlarge

OBJECT tag example:

Click To Enlarge

XHTML tag example:

Click To Enlarge

OR Use a simple HTML Form as follows:

Click To Enlarge

Step 5: Once the InfoCard UI refer to my prior post for screenshots of the UI shows up, Select the InfoCard you want to present. The IP ( Identity Provider ) generates a token and that token is posted as part of specified field ( in the example above, the field name is "xmlToken") to the targetUrl (in this example, InfoCardAuthenticationServlet).

You will notice that inside the OBJECT tag or XHTML tag, you could specify RP's policy such as issuer, token types, claim set, etc. I'm still learning new stuf here. I've not yet discovered everyhting.

The POST operation would look like the following:

POST /InfoCardAuthenticationTokenServlet HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 6478
Content-Type: application/x-www-form-urlencoded
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Encoding: gzip, deflate
Accept-Language: en-us
Host: www.YOURDOMAIN.com
Referer: https://www.YOURDOMAIN.com/InfoCardAuthenticationServlet
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
UA-CPU: x86
InfoCardSignin=Log+in&xmlToken=%3Cenc%3AEncryptedData+Type%3D%22http%3A%2F
%2Fwww.w3.org%2F2001%2F04%2Fxmlenc%23Element%22+xmlns%3Aenc%3D%22http%3A%2
F%2Fwww.w3.org%2F2001%2F04%2Fxmlenc%23%22%3E%34WVfaItHJTYU%2BsxIR1T25fi9k%
2FOc%2FMX7Q%2B6NSDs4nGqkn4rzqpez9BUWNZw7caVOrDeao

    .......
diZwfj0w06g199qlAqUMZEWxh0%3D%3C%2F
enc%3ACipherValue%3E%3C%2Fenc%3ACipherData%3E%3C%2Fenc%3AEncryptedData%3E

Step 6: Wait till I learn more and post more info here. In the meantime, If YOU know anything more, please share the info. It would help me too. Lets learn and share at the same time.

You could also see a list sites to which you have sent your infocards via the "site list" link in your infocard Identity Selector GUI.

click to enlarge

PS : Could someone show me how to post html code using the PRE tag on this blog. For some reason, the PRE tag on my blog just does not work. Am I missing something in my stylesheets?. If someone can help me resolve this issue, I'd save tons of time that I am currently using to create image snapshots of my code, uploading images and posting HREF links to them. It would really help if anybody could point me to some good resource which would enable me to POST HTML code within a PRE tag.