User Name:
Published: 12 Jan 2007
By: Tomas McGuinness.
In parts one and two we learned how to setup a server to accept a user card and we also learned how to enable a user to submit a card. In the following sections we're going to learn how to decrypt the card that has been sent to us by the card selector. Once the card has been decrypted we're going to access the information contained within the card and display it within a web page.
So, once a user has selected and sent a card to our application what do we do with it? Well, for starters,card Object you created. In order to view this token you need to create a page called cardprocessor.aspx. This was the target of the form. In our application it will be the responsibility of cardprocessor.aspx to extract and decrypt the token. It will then simply display the information contained within the card.
xmlToken
informationcard
This is a very simple form with one goal, to display the contents of the card that is submitted. Starting with login.htm, select a card. This will then redirect you to cardprocessor.aspx and you’ll be able to see the encrypted card details. It should look something like this snippet.Processor.aspx to call this class so that we can access the details of our Identity Card.
Remove the <script> block from CodeProcessor.aspx and open the code-behind page. Add the following code to the Page_Load method:
You’ll need to imports the System.IdentityModel.Claims namespace and also the Microsoft.IdentityModel.TokenProcessor namespace for the code to compile correctly. This code will decrypt the token, access the claims within the token and output them to the page. If you navigate back to Login.htm, select a card to submit and send it, you should see a page with this information on it:
System.IdentityModel.Claims
Microsoft.IdentityModel.TokenProcessor: tomas@idontwantspam.net: dio5cXHTu3V4nr92C/6/fXVuWBpQ5cUvYr5hiFTQis0=
These are the four pieces of information contained within the card that I submitted. The privatepersonalidentifier uniquely identifies our card.
Now, a word of warning. The first time I ran this application I got an exception:
A quite search on Google (where would I be without it?) and I found the answer within an MSDN forum thread. Since the card is encrypted using the Fabrikam certificate, our application needs read access to the private key component of that certificate in order to decrypt it our card. Follow the steps outlined in this post. It basically involves granting read permissions on the private key to the ASPNET user. If you are using IIS 6, grant permission to the NETWORK SERVICE user instead. The FindPrivateKey.exe should be in the bin directory of the sample you downloaded. If you can’t find please email me and I can supply you with it.
So that’s it. You’ve just completed a simple end to end application that uses CardSpace. Where do we go from here?
If you currently have a website that requires users to create an account before they can access the features you can now present them with an alternative. Instead of using a username to identify them, you can use the value contained within the privatepersonalidentifier. That was they can simply submit the same card to identify themselves to your website.
Having done this there should be one question on your mind; What if your user is sitting in an internet café and wants to access your site? Their Identity Card is sitting on their PC potentially thousands of miles away. Are they required to create a new account? I’m going to cover these particular scenarios in detail in several posts I’m planning for my blog.
If you have any comments or questions please don’t hesitate to contact me. I hope you’ve learned as much from reading these posts as I have from writing them.
Microsoft’s CardSpace: Part 1 – Getting startedMicrosoft's CardSpace: Part 2 - Creating and using your first identity card