Windows CardSpace: FAQ for ASP.NET Developers

Ankit — Tue, 19 Jun 2007 18:27:39 +0000

Few frequently asked question for ASP.NET developers:

The Identity Selector dialog box is displayed only for SSL protected pages. Therefore you are required to deploy your application on a Web server and install a SSL Certificate.
Windows CardSpace does not work with Self Signed Certificates and will die horribly. These certificates do not have CRL field. It contains a URL that CardSpace will check for the revocation list.
For ASP.NET developers there is Toolbox control written by Christian Arnold. Add this to your Toolbox and you won’t need to write a single line of code. Watch demo.
When you use CardSpaceLogin controls you must run application over SSL. The application pool also need to be run under Local Systems identify; otherwise w3wp.exe process will not be able to retrieve server’s private key. In such case you may end up with error stating Keyset does not exist. Note: This is not advisory if the application pool is shared with other Web applications. [ Edited: Refer Barry Dorrans comment for more details.]
When using Information cards there is nothing like passwords.
CardSpaceLogin controls are integrated with your identify providers such as Forms Authentication. For example: If you use Information Card to register a user, his details are reflected in the identify source.

Ankit Jain » security