Common Browser Add-On

The current version of the openinfocard identity selector now uses the same browser add-on code as DigitalMe (revision 2525 of IdentitySelector.js).
Although there are some additional features like the status-bar icon and the XRDS support.

openid is toast

Mike (one of those who need no sleep) blogged about Fun Communication's openid idtheft site and I encourage you to read Mike's post and try your personal idtheft immediately.

Back here?! Well, you knew all this already, didn't you?
But seeing it in action is another thing, I guess.

So where does this lead us? Remember the "openid dogfight" from September 2007? I too think that we need a spectrum of solutions. I agree that openid is for when an RP has "trivial" security requirements, but I think that trivial is not easy to define. At first your openid might be good enough for trivial things but its value grows with time. The more you use your openid the more valuable it becomes and then the risk you take by using the openid protocol becomes too great to accept. So let us all improve openid through e.g. PAPE. But why? To end up with another secure and inconvenient system? Thanks, no.

• back channels are bad (privacy, user consent). (SAML artefact)
• browser redirect protocols are bad (phishing). (openid protocol, SAML HTTP redirect binding)

Are CardSpace, Higgins' id selector, DigitalMe and openinfocard the solution? Not yet.
I think that the most important things that the Microsoft's vision of the Identity Metasystem until now has brought us are:

• thinking in claims instead of thinking of "login"
• identified the need for a unified user experience when PII is involved
• a client component to achieve the former two

Paul writes that his sxipper prevented the phish. This is a client component like CardSpace and the other id selectors.
We could integrate openid into the id selector and call it "identity agent" or whatever makes this idea stick. But then... Why use openid at all? This is so close to the origin of the security axis that we would need logarithmic scaling to make it visible.

Let us build this identity agent. Let us integrate openid and passwords into the client, but only as a migration path to a convenient and secure alternative.
Down with browser forms for claims/attributes. The browser is your friend.

Dynamic objects

Last autumn when a change in Firefox forced us to change the HTML object tag handling we kicked XBL and used DOM event handlers as the primary mechanism to detect and handle objects of type application/x-informationcard.

At that time the three id selectors that use this same piece of code openinfocard, CardSpace for Firefox (on codeplex) and DigitalME stopped working on sites that dynamically create or change the objects of this type.

Yesterday Barry from the SharpSTS project contacted me that his site does not work with "my" extensions... Well, at first I was reluctant to put too much work into supporting this javascript kungfu but Mike Jones persuaded me.
As it turn out it was not that much work as I expected.

Please download the new version from the codeplex site here.
A new version of the openinfocard id selector will be available soon too.

Here are some sites that now work again with the Firefox extensions:

FriendsWithCards


SharpSTS


Kim's Identityblog


These interop tests were done with Firefox 2.0.0.13 and CardSpace (.NET3.5).

OpenID leads to Information Cards

After a long pause you can hear the voice of the master of the identity metasystem again here. Kim Cameron explains why the success of openid leads to the success of CardSpace information cards.

Some sometimes forget that there are "alternative operating systems identity selectors". Examples are of course the openinfocard identity selector or the higgins based identity seletor digitalme. Which Kim mentioned in his post too.

New DigitalMe License

Three weeks ago the license for the DigitalMe Firefox launcher changed:

$ svn diff IdentitySelector.js -r1209
Index: IdentitySelector.js
===================================================================
--- IdentitySelector.js (revision 1209)
+++ IdentitySelector.js (working copy)
@@ -2,18 +2,18 @@
 // Desc:
 // Tabs: 3
 //
-// Copyright (c) 2007 Novell, Inc. All Rights Reserved.
+// Copyright (c) 2007-2008 Novell, Inc. All Rights Reserved.
 //
 // This program and the accompanying materials are made available
-// under the terms of the Eclipse Public License v1.0 which
-// accompanies this distribution, and is available at
-// http://www.eclipse.org/legal/epl-v10.html
+// under, alternatively, the terms of:  a) the Eclipse Public License v1.0
+// which accompanies this distribution, and is available at
+// http://www.eclipse.org/legal/epl-v10.html; or, b) the Apache License,
+// Version 2.0 which accompanies this distribution as is available at
+// www.opensource.org/licenses/apache2.0.php.
 //
 // To contact Novell about this file by physical or electronic mail,
-// you may find current contact information at www.novell.com.
+// you may find current contact information at www.novell.com.
 //
-// $Id$
-//
 // Author: Andrew Hodgkinson 
 //-----------------------------------------------------------------------------
-

I try to avoid licensing discussions but I guess it is better if I, with my openinfocard hat on, can choose between two alternative licenses.

ID Selector Selector

Is the Kevin Miller's Firefox extension an identity selector selector? I think that it is and was from the beginning (November 2006). When it was first released it was an identity selector selector that allowed one identity selector (CardSpace). Then Chuck Mortimore in December 2006 packaged his Firefox identity selector so that it was usable with the identity selector selector. Now the selector selector had something to select.

If you want to use e.g. DigitalMe with the identity selector selector than all you need to do is wrap it into a XPCOM component that follows Kevin's API.

Here is the current javascript interface:

Xmldapidentityselector.prototype = {

    GetBrowserToken: function (
     issuer , recipientURL, requiredClaims, optionalClaims , 
     tokenType, privacyPolicy, privacyPolicyVersion, 
     serverCert, issuerPolicy ) {
    }
}

All parameter are simple types except serverCert which is a nsIX509Cert. This could be a string too should somebody insist...

Calling the XPCOM component looks something like this:

var obj = null;
try {
 var cidClass = Components.classes[cid];
 if (cidClass != undefined) { 
     obj = cidClass.createInstance();
     obj = obj.QueryInterface(Components.interfaces.IIdentitySelector);
 } else {
     IdentitySelector.reportError("onCallIdentitySelector", "the class " + cid + " is not installed");
     return;
 }
}
catch (e) {
 IdentitySelector.throwError( "onCallIdentitySelector:", e);
}

/* Make the call to the selector */
identObject.targetElem.token = obj.GetBrowserToken(
 data.issuer , 
 data.recipient, 
 data.requiredClaims,
 data.optionalClaims, 
 data.tokenType,
 data.privacyUrl, 
 data.privacyVersion, 
 sslCert, 
 data.issuerPolicy );

Here is the current interface definition:

interface IIdentitySelector : nsISupports
{
  void About();
  string GetBrowserToken(in wstring issuerUri, in wstring recipientUrl, 
          in wstring requiredClaims, in wstring optionalClaims, 
          in wstring tokenType, in wstring privacyPolicy, 
          in long privacyPolicyVersion ,
          in nsIX509Cert certificate, in wstring issuerPolicy );
  string GetVersion();

  readonly attribute wstring errorstring;
  readonly attribute long errornumber;

};

This identity selector selector is not outside a browser; but... who cares!

Novell's javascript mania

Today I was looking for a mailing list that announces new versions of the DigitalMe identity selector. I started looking at the Bandit's project home page. And surfed to "bandit-announcements" which sounded interesting too. From there the browser gets redirected to Novell's login page where I choose "create account". This looks like this when you have scripts disabled:



And like this when javascript is allowed for novell.com:



CSS anyone? And than: this is another example of a page that has a "XHTML strict" doctype but that is NOT "XHTML strict" (120 errors). Sad.

Another, more important thing, comes to mind: Why can't I use a self-issued information card to provide account information and why can't I login with that same card afterwards? Please...

BTW: I did not create an account.

Good-Bye XBL

I just uploaded a new version (0.9.8) of the openinfocard id selector. You can find it in the project's download area.

Finally we got rid of the XBL code. There are several problems with XBL; the most notable beeing that bindings are not applied to objects in the head section of the html code on the relying party.

Andrew Hodgkinson had the idea to replace the XBL by a progress listener. The progress listener gets every event while the html code is parsed and the page constructed. Clever!

I tweeked Andrew's code a little bit, but all credit goes to him. Thanks.

Further new but somewhat experimental features in this release:
- the cardstore can now be where ever the user chooses it to be (as long as Firefox can treat it like a nsILocalFile). Everything that looks like a file-system should work.
- the cardstore is now encrypted with the Firefox master password (if one is set)
- the cardstore can be on a webserver (GET and POST). This is not tested.

BTW: There is a new version (1.0.4) of the CardSpace4Firefox extension.

Special thanks to Rob Richards too. Rob was the first to adapt Andrew's code for the openinfocard selector and he tested it againt many relying parties. He built a selector selector Firefox extension that calls the actual id selector. The id selectors implement Kevin Miller's API.
I think this is a good idea but somewhat inconvenient for the user because this concept requires two extensions to be installed.
I choose another way and implemented the selector selector in both extensions: openinfocard and CardSpace4Firefox. This way each selector is self contained and does not depend on other extensions. Each extension is programmed to be "friendly" to the other extensions that use the same progress listener scheme.

My plan for the next days is to integrate DigitalMe into the selector selector. Then we have all three id selectors in one instance of Firefox. Nice.

New Versions for Firefox 2.0.0.9

Please find the new version of the openinfocard id selector for Firefox 2.0.0.9 in the project's download area.
It is best used with the new version of the identity selector selector which can be downloaded from this project's download area.

I tested both with most of the relying parties in the table "I2 Relying Party results with Identity Selectors". First the id selector selector with CardSpace 1.0, then with the latest openinfocard id selector.
I did not test RPs that bugged me with certificate issues.
The ping identity advanced RP is Firefox unfriendly as ever, but it worked.
I did not test the no-SSL Microsoft RP with CardSpace 1.x because I don't have that installed. I tested the no-SSL xmldap relyingparty with the openinfocard id selector which works fine!



You might want to know what changed...
Well, to bad I did not take notes. I noticed that Firefox 2.0.0.9 works with IdentitySelector-1.0.1.xpi! From there I - very carefully and slowly - redid all the changes and feature integration again. In the end it worked. This is not really satisfying from a software engineering and quality assurance point of view... but who cares?!
<update> The major change with the id selector selector is that is now leaves the type of the object untouched. Formaly the type was set to "" to remove the dreaded browserNotification "Addidional plugins are required ...". I think changing the type of the object is dangerous and yields unpredictable results.</update>.
The major change with the openinfocard id selector is that it now detects the id selector selector and leaves the 'object type="application/x-informationcard"' handling to it. The id selector selector was better in handling the objects since it exists.

Next steps regarding object handling:

• I would like have the DigitalMe id selector integrated into the id selector selector. And I would like the openinfocard id selector to handle the objects alone if the id selector selector is not installed, but currently I don't know how to achieve both goals simultaneously.
• Test RPs with multiple objects outside of forms.

Thanks to Andrew Hodgkinson and especially to Boris Zbarsky (Mozilla guru) who asked the right questions.

Firefox 2.0.0.[8|9] xbl problem

There seems to be a bug/problem with the DigitalMe id selector, the openinfocard id selector and the perpetual-motion id selector selector and Firefox 2.0.0.[8|9]. Others report problems too.

If you want to use our id selector extensions please use Firefox 2.0.0.7 for now.

Curious what is going on inside the extensions? Then you should configure Firefox to show you. Please follow the instructions given here: Setting up extension development environment. Setting the preferences is easy. Just enter about:config into the address bar and go for it.
The current xbl problem is not visible here though, but sometimes a lot of warnings regarding faulty css .

One item from my relying party wishlist: Please adhere to standards XHTML, HTML, CSS! Sometimes it is hard to see the debug messages in all the warnings caused by the relying party code.