Cardspace Support for Firefox

During the last week I released new versions of the Mozilla Firefox addon that adds Cardspace support to the browser.

One feature that was reenabled was the ability to get the "value" of the object element using javascript. The value is the security token and thus requesting the value starts the selector. This "feature" was lost in the past and was quite easy to reactivate.

Another change that envolved code changes in many places was the elemination of global variables. Which is a good thing. All global variables were moved into a new namespace org.openinfocard.cs4ff. I hope that this change gets this addon out of the sandbox and it will become an addon that can be installed without the "let me install this" checkbox.

To bad that the Information Card addons are not compatible with each other. You have to make your choice whether you install DigitalMe, Openinfocard, Azigo's selector or Cardspace4Firefox. Or other addons based on the same code base.
Which on the other hand is no problem in the real world. Users will pick their selector and install just one.

Mozilla Add-On Workshop Berlin 2009

Last Saturday I attended the Mozilla Add-On Workshop in Berlin. It happened in the c-base which is a really cool location for this kind of events. Although the rooms are connected like pearls on a string which led to some traffic even during the sessions. Anyway it was a good event and I will go there again when it comes to Berlin again.
Things that impressed me:

• The new video capabilities of Firefox 3.1 are astonishing. You can implement real-time image processing inside the browser to have blue-screen effects or to track people moving in front of the camera or <what-ever-you-can-think-of-on-doing-to-a-bitmap>.
• DOM worker threads bring concurrency to javascript. This can be helpfull if you have a lengthy job to do but I fear that this can have astonishing effects.
• The Mozilla Lab's project weave has a new version. Try it. I think it should be easy to extend sharing bookmarks, open tabs, extension from machine to machine to Information Cards and Information Card stores too.

Things that need more work:

• Mozilla's build system. This is a monster.
  • I tried to build Firefox with Windows SDK 2008 and the .NET 3.5 framework -> no fun
• crypto support in Mozilla is poor. I need xmldsig, xmlsec and some "basic" digest and crypto (RSA-OAEP-MGF1P) in extensions.
• Java access from javascript extensions seem to go down the drain unless mozilla and sun do something.

Firefox XRD Extension II

I just uploaded a new version of the XRDS extension for Firefox and a version of the openinfocard extension that uses it.

When the extension xrds_pageinfo.xpi is installed then the openinfocard extension shows the list of cards that where used at this site. Hm, to be more precise: The list of Information Cards is shown of which a record of usage is stored in the cardstore. If you use the new "delete privacy data" feature of the openinfocard extension then no card usage is shown.





Also available in other languages than German.
have fun
Axel

Firefox Java Plugin(s)

Have you ever wondered how Firefox finds the Java plugin on Windows systems? The reason you might start to wonder is that Firefox finds the plugin even when you installed Firefox after you had installed Java...
The trick is that Firefox - as long as you don't configure it not to do this - scans the Windows Registry.


If you experience problems with the new NPRUNTIME version of the Java plugin you can disable it like shown in the picture. This solves problems Java based plugins like the openinfocard id selector have with this new and improved Java plugin.

Please note that this is (somewhat) independent of Firefox. Even if you have an older version of Firefox the new plugin's bugs can hurt you if you have a recent version of Java that contains the new npruntime version of the Java plugin.

I recommend to disable the new npruntime plugin for Java in Firefox.

Firefox 3 Java Bug with openinfocard

Just filed a bug for Firefox 3 and Java 6 Update 10 RC.

I maintain the Firefox extension "openinfocard"
http://code.google.com/p/openinfocard/downloads/list
Since Firefox3 users experience an error message "ReferenceError: java is not
defined". Today I tried whether this error still occurs with
jdk-6u10-rc-bin-b28-windows-i586-p-21_jul_2008.exe and ran into the error
message.
"TypeError: invalid 'instanceof' operand java.net.URLClassLoader" here:
http://code.google.com/p/openinfocard/source/browse/trunk/firefox/components/TokenComponent.js#272
This works with previous version of java.

Reproducible: Always

Steps to Reproduce:
1. Install the Firefox extension into FF3. Save to disk, then install.
2. navigate to a site that uses Information Cards e.g.
https://wag.bandit-project.org/BanditIdP/index.jsp
3. Click on the Information Card icon
Actual Results:
An alert dialog opens with the error message "TypeError: invalid 'instanceof'
operand java.net.URLClassLoader

Expected Results:
No alert but the identity card selector window opens and you can create an
information card (self-issued) that you can then use to provide your claims
about yourself.

CardSpace for Firefox new version

I just uploaded a new version 1.0.12 of the Firefox extension that enables CardSpace for Firefox.
This now works for the release version of Firefox 3. Although I know at least one site the drives the javascript kungfu to new heights and that does not work with this version... :-(( Fixed this!

Have fun; and happy testing. Please report issues!

Certificate Chain Verification for CardSpace

When Microsoft released .NET3.5 changes were made that are not that much visible on the surface. One of these changes is the verification of certificate chains. Formerly only certificates were "validated" but not up to the root certificate through the certificate chain. Mike Jones was so kind to notify me of this improvement and provided the (preliminary) documentation to implement this; and Caleb Baker clarified details where the documentation was indeed "preliminary". Thanks.

Today I am proud to announce a new version of the Firefox extension that enables support for CardSpace. It was tested with and without SSL and on .NET3.0 and .NET3.5 installations. It can live next to the openinfocard extension. Both extensions have in-browser selector selector capabilities. Both extensions advertise the id selector if the user requested this feature on the options page.

Implementing this reminded me of how much work the team around Kim Cameron has put into CardSpace and how well they did it and still do. Applause and thank you.

New Versions for Firefox 2.0.0.9

Please find the new version of the openinfocard id selector for Firefox 2.0.0.9 in the project's download area.
It is best used with the new version of the identity selector selector which can be downloaded from this project's download area.

I tested both with most of the relying parties in the table "I2 Relying Party results with Identity Selectors". First the id selector selector with CardSpace 1.0, then with the latest openinfocard id selector.
I did not test RPs that bugged me with certificate issues.
The ping identity advanced RP is Firefox unfriendly as ever, but it worked.
I did not test the no-SSL Microsoft RP with CardSpace 1.x because I don't have that installed. I tested the no-SSL xmldap relyingparty with the openinfocard id selector which works fine!



You might want to know what changed...
Well, to bad I did not take notes. I noticed that Firefox 2.0.0.9 works with IdentitySelector-1.0.1.xpi! From there I - very carefully and slowly - redid all the changes and feature integration again. In the end it worked. This is not really satisfying from a software engineering and quality assurance point of view... but who cares?!
<update> The major change with the id selector selector is that is now leaves the type of the object untouched. Formaly the type was set to "" to remove the dreaded browserNotification "Addidional plugins are required ...". I think changing the type of the object is dangerous and yields unpredictable results.</update>.
The major change with the openinfocard id selector is that it now detects the id selector selector and leaves the 'object type="application/x-informationcard"' handling to it. The id selector selector was better in handling the objects since it exists.

Next steps regarding object handling:

• I would like have the DigitalMe id selector integrated into the id selector selector. And I would like the openinfocard id selector to handle the objects alone if the id selector selector is not installed, but currently I don't know how to achieve both goals simultaneously.
• Test RPs with multiple objects outside of forms.

Thanks to Andrew Hodgkinson and especially to Boris Zbarsky (Mozilla guru) who asked the right questions.