Managing Information Cards with Windows CardSpace

Article
12/21/2009

CardSpace provides users the ability to access, create, and manage their Information Cards. In the same way that the information represented by bank cards, driver's licenses, passports, and credit cards are assured by an organization, each Information Card represents data that is digitally signed by a provider, either yourself or a third party. This document explores the concepts behind Information Cards, the parties involved, and the roles they play.

Information Cards

Information Cards are representations of data that is assured by a particular party. In the real world, the conventions for exchanging information are well known: people are trained to offer proof of their relationships with organizations by providing a card that the organization has issued and makes claims about the data. The data is exchanged with physical tokens (business cards, passports, driver's license) and by verbal tokens ("My name is Frank Lee, I work at Contoso."). Some cards are acceptable in some situations and not others. For example, the library accepts only library cards that it recognizes for checking out books, while a shop would certainly not accept the same library card as a token of credit.

Claims

Information Cards are the electronic equivalent to the cards that exist in the real world. Each card can be used in one or more situations, and some situations call for a specific type of Information Card, perhaps issued by a specific party, or providing specific information. CardSpace organizes these Information Cards and enables people to choose to present them at sites where they are accepted. The information expressed by the cards is called claims and is stored at the card issuer, rather than on the local computer. The CardSpace identity selector stores the metadata for the cards in protected storage on the local computer. (In Windows Communication Foundation (WCF), claims are also the basis of the Identity Model used to manage authorization. The claims in an Information Card correspond directly to the Claim types found in a ClaimSet. For more information, see Managing Claims and Authorization With the Identity Model.)

The Context for Information Cards

The usage of Information Cards depends on the context. The context of any situation is the sum of three questions:

What claims are you looking for?
Who is asserting those claims?
Who is asking for this information?

Claims can be anything that makes sense for a particular purpose. One claim might be a person's age, another might be an address, or there may be a claim that the user has a cat called "Marie."

In some cases, sites will choose to accept only cards issued by specific, trusted providers. In other cases, a broader set of cards are appropriate, including cards where the individual user is the issuer of the information. An online shop would accept the creditworthiness of a person if that person's bank had safely communicated that information to the shop.

In particular situations, a user would not want to give out certain details to some parties. Credit-card numbers would be inappropriate to give out in a chat room as a form of identity.

Elements of the interaction

Interactions involving Information Cards involve three participants. The user (also called "Subject"), holds the Information Card, which contain the metadata of the claims. The Relying Party is the Web site, service, or company that accepts the information in the claims. The Identity Provider is the agent who is asserting the claims about the Subject.

The Relying Party decides what data they require and who they are willing to trust. The Relying Party also determines whether it wishes to use SSL encryption to protect the identity exchange. This information is communicated to CardSpace, which will filter the cards the user is able to send to the Relying Party. After the user has selected a card, the user must then authenticate himself or herself to the Identity Provider, at which point the Identity Provider can release the information back to the user, in a signed and encrypted token. The user has the ability to view the token, but not modify it; it is digitally signed by the Identity Provider. If the user approves of the information being sent, the token is then passed to the Relying Party. Once the Relying Party has decrypted the token and verified the signature, it uses the claims data to facilitate actions taken for the user who released them.

Types of Information Cards

There are two types of Information Cards supported by CardSpace: Managed cards and Personal cards (also called self-issued cards).

Managed cards are cards that an Identity Provider has given to the user, who has imported it into Identity Selector. Identity Providers declare the claims they support in their cards using URIs. Separate Identity Providers can collaborate on the URIs they use to declare their claims, or make up ones specifically for themselves.

Personal Cards are cards that the user is also acting as the Identity Provider, and the user provides all the values for the claims. CardSpace provides the facility for the user to create, edit, export, and import Personal Cards. The data for these cards is encrypted and stored on the user's computer. The claims that a Personal Card can support are fixed, so that Relying Parties can accept a common, consistent Information Card.

The Windows CardSpace Identity Selector

When a user interacts with the CardSpace Identity Selector, either by starting the CardSpace control panel applet, or through an application or Web site requesting an Information Card, the CardSpace is run in a separate desktop session, preventing other applications from interacting or interfering with it.

To view this in action, do the following.

Demonstrating CardSpace in a different desktop

Start the Windows Task Manager by pressing Ctrl+Shift+Esc.
Select the Performance tab.
Move the Windows Task Manager window so that it is flush with the right-hand side of the screen.
Notice that the CPU Usage History is scrolling horizontally.
Start CardSpace by clicking on the Start menu, then click Control Panel.
Double-click the Windows CardSpace icon.

Note

When CardSpace starts, notice that the desktop is dimmed, and the Task Manager appears frozen. The desktop will continue to be inaccessible until CardSpace is closed. At that point, the CPU Usage History will jump forward (indicating that it has been running in the background the entire time).

Share via