Windows CardSpace

Windows CardSpace

The Windows CardSpace user interface, showing card creation template example.
Developer(s)	Microsoft
Operating system	Microsoft Windows
Successor	U-Prove
Service name	Windows CardSpace (idsvc)
Type	Identity management system

Windows CardSpace (codenamed InfoCard) is a discontinued identity selector app by Microsoft. It stores references to digital identities of the users, presenting them as visual information cards. CardSpace provides a consistent UI designed to help people to easily and securely use these identities in applications and web sites where they are accepted. Resistance to phishing attacks and adherence to Kim Cameron's "7 Laws of Identity" were goals in its design.

CardSpace is a built-in component of Windows 7 and Windows Vista, and has been made available for Windows XP and Windows Server 2003 as part of the .NET Framework 3.x package.

Overview

When an information card-enabled application or website wishes to obtain information about the user, it requests a particular set of claims. The CardSpace UI then appears, switching the display to the CardSpace service, which displays the user's stored identities as visual cards. The user selects a card to use, and the CardSpace software contacts the issuer of the identity to obtain a digitally signed XML token that contains the requested information. CardSpace also allows users to create personal (also known as self-issued) information cards, which can contain one or more of 14 fields of identity information such as full name and address. Other transactions may require a managed information card; these are issued by a third-party identity provider that makes the claims on the person's behalf, such as a bank, employer, or a government agency.

Windows CardSpace is built on top of the Web services protocol stack, an open set of XML-based protocols, including WS-Security, WS-Trust, WS-MetadataExchange and WS-SecurityPolicy. This means that any technology or platform that supports these protocols can integrate with CardSpace. To accept information cards, a web developer needs to declare an HTML <OBJECT> tag that specifies the claims the website is demanding and implement code to decrypt the returned token and extract the claim values. If an identity provider wants to issue tokens, it must provide a means by which a user can obtain a managed card and provide a Security Token Service (STS) which handles WS-Trust requests and returns an appropriate encrypted and signed token. During the 2000s, identity providers that didn't wish to build STS could obtain one from a variety of vendors, including PingIdentity, BMC, Sun Microsystems, Microsoft, or Siemens.

Because CardSpace and the identity metasystem upon which it is based are token-format-agnostic, CardSpace did not compete directly with other Internet identity architectures like OpenID and SAML. These three approaches to identity can be seen as complementary, because during the 2000s, information cards could be used today for signing into OpenID providers, Windows Live ID accounts, and SAML identity providers.

IBM and Novell planned to support the Higgins trust framework to provide a development framework that includes support for information cards and the Web services protocol stack, thus including CardSpace within a broader, extensible framework also supporting other identity-related technologies, such as SAML and OpenID.

Release

Microsoft initially shipped Windows CardSpace with the .NET Framework 3.0, which runs on Windows XP, Windows Server 2003, and Windows Vista. It is installed by default on Windows Vista as well as Windows 7 and is available as a free download for XP and Server 2003 via Windows Update. An updated version of CardSpace shipped with the .NET Framework 3.5. The new Credential Manager in Windows 7 uses Windows CardSpace for the management and storage of saved user credentials.

Discontinuation

On February 15, 2011, Microsoft announced that Windows CardSpace 2.0 would not be shipped. Microsoft later worked on a replacement called U-Prove.

See also

• Information Card
• Higgins project
• Shibboleth (Internet2)
• Identity management systems
• Windows Hello

Further reading

• Bertocci, Vittorio; Serack, Garrett; Baker, Caleb (December 27, 2007). Understanding Windows CardSpace: An Introduction to the Concepts and Challenges of Digital Identities. Addison-Wesley. ISBN 978-0-321-49684-3.
• Nanda, Arun (April 2007). Identity Selector Interoperability Profile (PDF). Microsoft.
• An Implementer's Guide to the Identity Selector Interoperability Profile V1.0 (PDF). Microsoft, Ping Identity. April 2007.
• Jones, Michael B. (April 2007). A Guide to Using the Identity Selector Interoperability Profile V1.0 within Web Applications and Browsers (PDF). Microsoft.
• Microsoft Open Specification Promise, May 2007.

External links

Software development

• Windows CardSpace on .NET Framework documentation site – Developer articles and technical documentation on Windows CardSpace
• Microsoft Information Card Kit for ASP.NET 2.0 – ASP.NET Relying Party (RP) code to support CardSpace
• Microsoft Information Card Kit for HTML – platform-independent JavaScript and CSS code that detects if the client can use i-cards and provides the corresponding UI support
• Open source Ruby RP code for accepting information cards
• Open source Java RP code for accepting information cards
• Open source C and PHP RP code for accepting cards
• Open source C RP code for accepting information cards and STS code for managed i-cards
• Open source PHP Archived 2007-11-12 at the Wayback Machine Security Token Service code for managed cards
• Open source C# Archived 2013-06-16 at the Wayback Machine STS code for managed information cards

Identity selectors

• Digital Me Archived 2012-01-13 at the Wayback Machine – an open-source Identity Selector for Linux and Mac OS X
• A plug-in Archived 2006-11-07 at the Wayback Machine for Apple's Safari implementing an Information Card identity selector
• A plug-in for Firefox to activate CardSpace and other identity selectors

Blogs

• Kim Cameron's Identity Weblog – Blog from Microsoft's architect for identity
• Mike Jones: Self-Issued – Blog on CardSpace, cards, and digital identity from Microsoft's Director of Identity Partnerships
• Vittorio Bertocci (archived) – Blog on designing and developing with CardSpace from Microsoft's architect evangelist for Windows Server 2008
• Claim-Based Identity Blog (archived) – Blog on CardSpace from its development team