informationcardruby Work Item Rss Feed

CLOSED TASK: Logging strategy

joepoon — Mon, 25 Jun 2007 18:48:05 GMT

Reminder to investigate the logging strategy for information card ruby.
Comments: Migrating off of Codeplex

CLOSED FEATURE: Auto-populate user fields on registration with information card

joepoon — Mon, 25 Jun 2007 18:48:04 GMT

As a user, it'd be nice if the fields (ex. username, email address) would populate from the claims in the information card (if present).
Comments: Migrating off of Codeplex

CLOSED TASK: Performance Review

joepoon — Mon, 25 Jun 2007 18:48:04 GMT

This is a reminder to review the performance - epescially when it comes to parsing & examing the encrypted and SAML tokens.
Comments: Migrating off of Codeplex

CLOSED TASK: Security Review / Threat Model

joepoon — Mon, 25 Jun 2007 18:48:03 GMT

Examine the security vulnerabilities to exercise due diligence when providing a plugin/library that performs user authentication for sites.
Comments: Migrating off of Codeplex

CLOSED TASK: Validate SAML Schema

joepoon — Mon, 25 Jun 2007 18:48:01 GMT

Should the SAML document be validated against a schema?

Also, the schema does not allow "colons" in the AssertionID, yet the SAML tokens generated have "colons."
Comments: Migrating off of Codeplex

CLOSED TASK: Support encryption algorithms

joepoon — Mon, 25 Jun 2007 18:48:00 GMT

As a developer, I would like to support both http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p and http://www.w3.org/2001/04/xmlenc#rsa-1_5 algorithms for decrypting the incoming information card token.
Comments: Migrating off of Codeplex

CLOSED TASK: Support x509 certificates in SAML KeyInfo

joepoon — Mon, 25 Jun 2007 18:47:59 GMT

As a developer, I would like the library to support scenarios where the public key of the identity provider uses x509 certificates.
Comments: Migrating off of Codeplex

CLOSED TASK: Protect against replay attacks

joepoon — Mon, 25 Jun 2007 18:47:58 GMT

As a developer, I would like the library to protect the end user from replay attacks (ensure that the assertion id has not been used within the same window before).
Comments: Migrating off of Codeplex

CLOSED FEATURE: Detect for information card enabled browser

joepoon — Mon, 25 Jun 2007 18:47:58 GMT

s a developer, I would like a mechanism for detecting if the user is using an information card enabled browser.

Script code can detect browser support for Information Cards within Internet Explorer by testing the userAgent string to determine whether the browser version is greater than or equal to "MSIE 7.0". A second issue with Internet Explorer 7 is that the Information Card support might not be installed (because Microsoft .NET Framework 3.0 is not installed on the machine). This can be detected within the browser by using the "isInstalled" property on the Information Card OBJECT from scripting code. .NET 3.0 installation can be detected on web servers by testing whether the userAgent string contains ".NET CLR 3.0".

For example, the userAgent string on a Windows XP machine using IE 7 and .NET 3.0 will contain at least these elements:

MSIE 7.0; Windows NT 5.1; .NET CLR 3.0.04506.30
Comments: Migrating off of Codeplex

CLOSED FEATURE: Specify policy via XHTML Syntax

joepoon — Mon, 25 Jun 2007 18:47:57 GMT

As a developer, I would like the option of specifying the security policy via XHTML syntax (as opposed to OBJECT tags) to handle the scenarios where OBJECT tags are not supported.
Comments: Migrating off of Codeplex

CLOSED FEATURE: Specify policy via WS-SecurityPolicy

joepoon — Mon, 25 Jun 2007 18:47:57 GMT

As a developer, I would like to specify the security policy via WS-SecurityPolicy.

The most straight forward way to specify the policy is via HTML extensions which signal to the browser when to invoke the Identity Selector.

http://msdn2.microsoft.com/en-us/library/aa480726.aspx
Comments: Migrating off of Codeplex

CLOSED FEATURE: Guideline for integrating library / plugin to your rails site

joepoon — Mon, 25 Jun 2007 18:47:56 GMT

As a developer, I would like to have a guideline as to how to support information cards on my rails site.
Comments: Migrating off of Codeplex

CLOSED TASK: Generate unique ID from SAML token

joepoon — Mon, 25 Jun 2007 18:47:53 GMT

As a developer, I would like for the SAML token to provide me a unique ID such that I can identify this user in the database.

To identify a user, a unique id will be generated from the received SAML token. This could be generated from as hash of the Issuer's key + PPID (Identification Claim type).

A question that is up for discussion is what happens if the PPID is not a required claim? What would the uniqueID resolve to?
Comments: Migrating off of Codeplex

COMMENTED FEATURE: Redirect user to SSL