Infocard

After quite some time, version 1.2.2 has finally been released. It can be downloaded at: http://xmlseclibs.googlecode.com/files/xmlseclibs-1.2.2.tar.gz

Changes include:

Features:
- Add support XPath support when creating signature. Provides support for
working with EBXML documents.
- Add reference option to force creation of URI attribute. For use
when adding a DOM Document where by default no URI attribute is added.
- Add support for RSA-SHA256

Bug Fixes:
- fix bug #5: createDOMDocumentFragment() in decryptNode when data is node
content (patch by Francois Wang)

Please submit any bugs or feature requests into the Issue Tracker.

Slides have been posted for the latest version of my Digital Identity talk.

The contents is a bit less technical than in the past and is aimed at wider audience than just developers. Please contact me if there are any questions on the material or topics presented. Rob Richards.

You can also find the slides from my OAuth presentation.

Slides have been posted for the latest version of my Digital Identity talk.

This talk has evolved since I first starting giving it, but the latest version simple needed more time to present. I was asked to combine all the topics (OAuth was to be its own presentation) into one, which I probably won't do again. Even just only covering the absolute basics, I found that there just isn't enough time to cover them all in the short amount of time, so some material was skimmed over. If anyone has any questions on any of the material, please feel free to contact me.

The long awaited 1.2.1 release finally sees the light of day.
It can be downloaded from:
http://xmlseclibs.googlecode.com/files/xmlseclibs-1.2.1.tar.gz


Changes include the following:

Features:
- Attempt to use mhash when hash extension is not present. (Alfredo Cubitos).
- Add fallback to built-in sha1 if both hash and mhash are not available and
throw error for other for other missing hashes. (patch by Olav Morken).
- Add getX509Certificate method to retrieve the x509 cert used for Key.
(patch by Olav Morken).
- Add getValidatedNodes method to retrieve the elements signed by the
signature. (patch by Olav Morken).
- Add insertSignature method for precision signature insertion. Merge
functionality from appendSignature in the process. (Olav Morken, Rob).
- Finally add some tests

Bug Fixes:
- Fix canonicalization for Document node when using PHP < 5.2.
- Add padding for RSA_SHA1. (patch by Olav Morken).

This library has undergone extensive testing prior to release so, please
let me know if anyone runs into any issues.

Now that I've settled into my job at Mashery, I've starting getting a chance to get back to some of my side projects. On the information card and openinfocard front, I am currently looking at getting the selector to export and import cards so that I can synch up my cards amongst my different selectors. More importantly though, I will be in San Francisco for work in little over a week, allowing me to attend and participate in the OSIS User-Centric Identity Interop event at the RSA Conference. While I only play an insignificant role in the openinfocard project, I will be there as part of that project as well as representing my own information card code.

We even have our own logos . Axel did a great job coming up with a logo for openinfocard. As I was up at the PHP Quebec conference when they asked for logos, Julie was kind enough to quickly pull one together for me. With under 24 hours to get it done, no graphic utilitities installed on her new macbook and extremely bad internet bandwidth to even try to download any applications, I think she did a fantastic job.

Anyone interested in participating or seeing demonstration of the identity technologies should be sure to check it out on April 8th and 9th from 11am - 6pm. As I am out there primarily for work, I will most likely will be there later in the day. If you can't make it but are interested in getting involved, interoperability testing is currently underway.

Updated 04-03-2008: The openinfocard logo has been changed to the one now displayed

For a long time now I have been saying that I need to get the library within a public source repository, write documentation, etc... Thanks to Andreas Solberg, all of this is finally coming to fruition. He has setup a home page for xmlseclibs, as well as the xmlseclibs project at Google Code. Things are still in the early stages, so there is still no documentation, but at least everyone now has access to the source repositry, mailing list and bug tracker for it. Documentation is something sorely needly, so if anyone would like to help in this aspect, please contact me personally or send a message to the mailing list.

2008 is sure off to a lousy start. I went back to work the first work day of the new year after some relaxing time off just to be told the entire IT department has been let go effective immediately. I am just praying this isn't an indication about how the rest of the year is going to go. I get enough of the open position emails, but the trouble is that I am not going to leave Maine. I like it here and it's a great place to raise a family. That being said, if anyone is looking or knows of someone looking for a developer in Maine (I'm trying to avoid doing Java full time) or that allows for a full time telecommuter, I would appreciate any leads: You either already have my email address or contact me via: =rob.richards.

As far as outside projects I am involved in and work on, I do plan on continuing working on them, although I might be a bit MIA for some time until I get settled. My apologies for tagging this in all categories, but hey I need to get maximum exposure here.

I was meaning to write about some of the new openinfocard features this weekend, but instead I spent my time trying to get the openinfocard selector working against the Windows Live Beta site supporting Information Cards. I finally found the problem and really just could not believe it. A few months ago, I received a similar, yet unrelated, bug report against my own libraries. A person was using my wsse/xmlsec libs to communicate against a .NET SOAP service that required messages to be signed and told me that it would not work unless the XMLDSIG elements used a default namespace. This means that ... would work, while .. would not. Anyone who works with XML is fully aware that these two are exactly the same, so I just couldn't accept that. In fact, when mixing namespace (as often is the case when working with XMLDSIG and XMLENC) its easier to read the document when prefixes are used.

Within my libraries, I do prefix namespaces. Unfortunately for that person, I did not believe them and stressed that it had to be a coding error either on their part or from the service provider. Note that I didn't just dismiss their report. I was unable to reproduce the issue, was not given access to test against their service, do successfully interoperate with other .NET systems, and have a large number of users implementing my code against .NET services employing encryption and digital signatures. I hadn't heard anything more and ended up forgetting about it... that is until now.

Over the weekend, I spent a good amount of time comparing tokens from various selectors and trying different parameters. There were only two differences between tokens from Openinfocard and those from CardSpace. The first, which I spent most of my time on, was the timestamps. CardSpace provides a full hour for token validity. Openinfocard, on the other hand, allows the token 10 minutes of validity. I have run into a number of problems in the past due to the clock from either the client or server not being in synch. A fudge factor is usually built into the interactions (the client might set their NotBefore time to a few minutes prior to the current time, and the server might allow an extra ten minutes past the expire time), but I have seen cases, especially due to day light savings and systems not being updated, that the clocks between the client and server are too far off and the token is not considered valid when submitted. Anyways, this didn't end up being the problem.

Come to find out, the Windows Live Beta site has the exact same problem when dealing with the SAML token as the bug reported I told you about before. The issue is unrelated to the client code (so thankfully it wasn't an issue in my library - written in PHP); Openinfocard, which is the selector having a problem working with Windows Live, is in fact written in Java, and also prefixes namespaces. After altering the openinfocard code to use default namespaces, building new jars, installing the new jars and restarting firefox (sounds simple, yet REALLY time consuming), I finally got Windows Live to accept my Infocard. The underlying problem itself still eludes me. All I know is that the issue lies on the server side. I have no idea if this is a problem stemming from a particular version of the .NET libraries or if a third party library is being used.
Either way, I would have expected more from Microsoft. It's forgivable that a developer from a small company might use an outside library to work with digital signatures (that also happens to be buggy), but for a company that pushes the WS-* stack (XML Digital Signatures being a core component of WS-Security) and provides core libraries for working with it, this is a serious issue. It also seems to not be isolated either; as exemplified by the same issue against a .NET SOAP service.

Now hopefully someone can get me some answers to where this problem stems from so in the future I have a little more insight if I personally end up encounter it when dealing with a SOAP service; or at least can provide some help to someone reporting the issue to me again.

A lot has been happening in the world of identity selectors and I'm finally getting around to mentioning some of it. In the past, you might have noticed that on my linux machine, outside of the openinfocard selector, I have had little to no luck with any other selectors. Things have finally changed in this regard. You might be aware of the DigitalME selector. I may be mistaken, but believe it to have been the first selector available for the Mac. There is still no Windows support, but I did find a Fedora 7 rpm available for download. As I had recently upgraded to Fedora 8, I decided to give it a try and was pleasantly surprised with the results. As you can see from the following screen shots, it is really clean and polished, oh I forgot to mention the big thing that is also works (for the most part).

If you look at the larger image, you will notice the selector divided between 2 parts. Within the "My Cards" section, I have selected the CData Personal card (notice its highlighted). To the right, you are presented with the claims that will be submitted with the card.; Personal Private Identitifier (which I have blurred out), my given and surname (Rob Richards) and finally my email address. The last two items listed (http://www.bandit-project.org/identity/claims/groupmembership and http://burtongroup.com/interop/2007/05/identity/cameratype) are optional claims for which I am not providing any data for.

As you can see, I am now successfully logged into the system. It breezed through some of the sites I test against and worked fine with my own managed card demo. I did run into a few glitches. I think the wrost happened to be when firefox had launched the selector and I accidentally clicked on something outside of the selector; cuasing it to go to the background. Well, my desktop ended up to be a bit useless at that point. Everything was greyed out, since I was the stages of selecting a card, but I couldnt get the selector to come back and no clicks or key presses did any good. I ended up having to reboot at that point (And this, folks, is why I test out new selectors within a VM).

Now, this doesn't mean I am switching my selectors. Although for most people, I would recommend using DigitalME over openinfocard, mostly due to the fact that openinfocard is currently a development selector with lots of debug code too, but also DigitalME looks slick; still not up to the CardSpace eyecandy level, but getting there. I have been using openinfocard for well over a year now and think I'll stick it out with it and see where it goes. Plus, there's plenty of work to be done on it, so when I have time I try to help (though pitiful it may be), with it.

One change in the works I am looking forward to see developed is the identity selector selector, which is currently in its infancy stage. The problem boils down to the possibilty of having multiple selectors installed. How does a browser determine which selector is launched when called for? On the simplest level, the identity selector selector would allow a user to specify which selector they would like to use, so when one is called the correct one is launched. This stems from a firefox extension to support CardSpace. Work is now being done for a plugable system so that selectors can fit within this framework, providing the user with choice rather than selector conflicts.

Another change that has occured is the usage of Infocarmation cards without the requirements of SSL. CardSpace rolled out this change in the 3.5 .NET release. Other selectors, such as the latest openinfocard releases, already support this functionality. You can test this against a little demo I wrote: Non-SSL Infocard support. This takes advantage of my latest infocard-lib library, which simply by passing False as the third paramter to the processCard function, handles the non-ssl enabled communications without any other code changes.

These are just a couple of the changes that have/are happening, but imo a little more noteable than others given an end user perspective. Personally I am excited over some of the changes that have been made to the openinfocard selector (i.e. remote card storage). Those, however, I will leave for another day. Given that there happens to be a nice snow storm heading into Maine this weekend, I expect to have plenty of time to present some of those changes.

Life and work have been eating up all my time, so I have had no time to write anything about what's been going on. I finally decided to take a break from work, sit down and try to catch up with things.
Although busy, I have been updating my libraries; adding deatures, fixing bugs and trying to get some structure going. The libraries are used by a good number of projects, so I figured it was about time to make some of the changes known. First off, I started tracking versions and keeping changelogs for the different libraries (Only those that have changed since I started version tracking have changelogs right now). The libraries can all be found on my Source Code page. As for some of the specific changes....