JMPInline

Feedback requested: New OpenID RP login UX prototype

2009-10-22T15:57:00.001-07:00

OpenID RP login UX Live demo location: http://openidux.dotnetopenauth.net/ Design considerations The DNOA login UX design document contains the design spec, and some of the reasoning that went into that design. One high-level goal of all this work is to produce a set of HTML, CSS, and JS files that can work on any web platform, so that ruby, python, php, coldfusion, and (of course) ASP.NET

Minify your EmbeddedResource .js and .css files in your MSBuild project

2009-10-10T15:57:00.002-07:00

If you write a C# or VB.NET class library that contains ASP.NET controls that also have .js or .css files embedded in your assembly, you probably want to minify those files for optimal download size in production, but keep the files readable for coding and debugging. What if you could add a single

VS2008 project template for OpenID and InfoCard relying parties

2009-10-09T11:22:00.001-07:00

I finally built a project template to make it easier to write an OpenID relying party web site using C# and ASP.NET. Up to this point all we had were the sample RPs that ship with DotNetOpenAuth, which were deliberately kept simple. They didn’t use a real database, didn’t follow some best practices, and weren’t very real. Now you can start your next web site with OpenID and InfoCard logins

Optimal OpenID UX finally underway

2009-09-25T21:47:00.001-07:00

I’m finally making progress on building a set of HTML and javascript files that can be used on any OpenID relying party web site to allow visitors to easily log in with OpenID, without even knowing what OpenID is. I mentioned my goal to do this some time ago, and now I have a small partially functional prototype. Please try it out, and keep coming back and letting me know what you think of it

How to easily fetch OpenID attributes, regardless of the Provider

2009-09-07T16:20:00.001-07:00

In a previous article, I bemoan the pain of writing an OpenID Relying Party that wants to fetch user attributes from their OpenID Provider, because of the at least 4 ways in which those attributes must be requested. And then later I promised that DotNetOpenAuth would offer help to alleviate that pain. That help has come. It actually came way back on June 26, 2009. But only now did I

DotNetOpenAuth v3.2 is done

2009-06-27T08:04:00.001-07:00

DotNetOpenAuth v3.2 just came off the presses. Lots of feature work and a few interop fixes in this release. The biggest highlights being: Very simple story for both RPs and OPs interested in interoperating with others whether they use sreg or one of the several AX formats (finally!) OAuth 1.0a support PPID generation for OPs to protect customers' privacy. Go download it. As

How to get ILMerge to work with .PFX files

2009-06-24T20:37:00.001-07:00

ILMerge is an excellent tool for “linking” multiple assemblies into one. But one of its switches, /keyfile:, which allows it to sign the resulting merged assembly, only accepts .snk files. It reports no error if you feed it a password-protected .pfx key-pair file, but the resulting assembly is invalid. >ilmerge /keyfile:some.pfx /out:merged\some.dll some.dll someother.dll >sn -v merged\

Help is coming for the Sreg/AX interop problem for OpenID

2009-06-20T07:23:00.001-07:00

Just to get your mouth watering for DotNetOpenAuth v3.2... V3.2 has a new "behaviors" plugin capability that lets RPs and OPs get additional functionality with very little effort. For example, OPs can add PPID identifier support very easily with just a few lines of code. But of most interest I suspect is the sreg/AX interop behavior, which if activated in your web.config file (1 line), will

Reverse engineering ASP.NET Membership passwords and salts

2009-06-12T15:49:00.001-07:00

I’m working on a project that was using the ASP.NET SQL Membership and I needed to remove the Membership provider from the system since we wanted more control over the user tables. Our existing users had passwords that ASP.NET Membership had hashed and salted, and we needed to be able to maintain those user accounts, which means we have to be able to validate logins against the salted passwords.

Caching results of .NET IEnumerable generator methods

2009-05-26T17:03:00.001-07:00

If you're already familiar with generator methods and want to jump to intelligent caching of their results, skip further down in this blog post. In C#, generator methods are methods that use yield return to return an IEnumerable

Uri.EscapeDataPath and HttpUtility.UrlEncode are NOT the same

2009-05-11T16:59:00.002-07:00

For some reason Microsoft defined URI escaping twice: Uri.EscapeDataString and HttpUtility.UrlEncode seem to cover the same need. There’s another pair: Uri.EscapeUriString and HttpUtility.UrlPathEncode which again seem to be redundant with each other. But in particular I found a small difference in behavior between the first two methods that should be called out.

Recent OpenID relying party vulnerabilities

2009-04-21T11:23:00.001-07:00

The OSIS I5 OpenID interop testing is well underway. Last weekend while testing some OpenID relying party web sites, John Bradley happened upon a web site that failed a particularly alarming test. Further investigation revealed that the security hole affected all OpenID relying parties based on Janrain’s Ruby OpenID library. Perhaps Janrain is using its Ruby library for RPXNow, because I

DotNetOpenAuth 3.0 released

2009-04-16T11:40:00.001-07:00

Download it now. Previously named DotNetOpenId in its v1.x and 2.x releases, the v3.0 release is rechristened DotNetOpenAuth to reflect its support for multiple authentication and authorization protocols. Sporting OpenID, OAuth and InfoCard support in its initial incarnation, it has been re-architected and largely rewritten to make adding more protocols fast and less error-prone. Even if you’

How to pretty much guarantee that you might get an email address with OpenID

2009-03-30T15:15:00.001-08:00

OpenID itself is just an authentication protocol. It takes OpenID extensions to get more information about the user like their name or email address. In fact there are two popular extensions that can provide this kind of information: Simple Registration (sreg) and Attribute Exchange (AX). A web site that wants to accept OpenID logins (this site is called a relying party, or “RP”) and also

Need access to that internal? Don’t touch that dial!

2009-03-16T13:10:00.001-08:00

The blessing and curse of open source is that the source can be easily changed. Internal types and members don’t need to be backward compatible with previous versions. This makes fixing bugs and feature enhancements much easier in future versions of the software. Making types and members internal cuts down on documentation that must be written, read and maintained. It protects callers from

DotNetOpenAuth 3.0 Beta 2 released

2009-03-11T20:47:00.001-08:00

DotNetOpenAuth, previously named DotNetOpenId, is getting nearer to its major 3.0 release. With beta 2, we have a security reviewed, feature complete library for .NET use of the OAuth and OpenID protocols. Although Beta 1 was very rough and was not recommended for use in production, Beta 2 has passed enough security, interop and stability tests to warrant live web sites to use this version.

Replay protection for OpenID 1.x relying parties

2009-03-07T21:34:00.001-08:00

If you’re writing an OpenID Provider, you should have a strong appreciation for the security of your customers’ identities that you will be protecting. One aspect of that protection is against replay attacks, where a man-in-the-middle sniffs the identity assertion from a Provider and replays it against the same relying party and manages to log in as the victim. OpenID 2.0 provides built-in

OpenID association poisoning

2009-03-07T21:14:00.001-08:00

As part of the OpenID protocol a relying party often establishes shared secrets (called ‘associations’) with identity providers that are used to verify identity assertions. It occurred to me that an OpenID relying party might easily introduce a major security hole in the process of establishing an association that could allow identity spoofing. Each association is assigned a handle, which is a

Fixing the OpenID login user experience

2009-02-28T19:35:00.001-08:00

The user experience of OpenID at Relying Party web sites is so important to get right. OpenID is right for your web site's visitors – no doubt in my mind about that. But we need to make sure it's very easy for your visitors to use so you don’t lose them when they've been pre-wired for the password anti-pattern. Several big companies like Yahoo and Google have invested a lot of effort into

DotNetOpenId v3.0 Beta 1 released

2009-02-04T22:21:00.001-08:00

Tonight DotNetOpenId, soon to be renamed DotNetOpenAuth, released beta 1 of the major v3.0 release. You can download the bits from Ohloh. Although downloads should remember that as a beta this version should not be used in production, there are several new features that should be worth investigating and building a web application around while the final release is still in development: OAuth

DotNetOpenId is looking for a new home

2009-02-02T07:00:00.001-08:00

DotNetOpenId started on Google Code. But we’re outgrowing it. We’d like to move to a shared hosting server where we can have automated tests, nightly builds, and a better web site and online documentation. This new web site will cost real money though, which is beyond my FOSS-hobby budget. Please if you like DotNetOpenId, consider making a donation toward making this happen!

DotNetOpenId v3.0 to feature built-in OAuth support

2009-02-01T20:34:00.000-08:00

The next major release of DotNetOpenId, slated for a release in or around March 2009, will add OAuth support to the mix. If you don’t know what OAuth is, it basically provides a way for your site’s visitors to authorize your site to download their email address book without giving you their email address and password. It’s of course much bigger than that, but that’s the easiest way to start

Why using RPXNow is a bad idea

2009-01-17T11:07:00.001-08:00

Janrain has been a great influence in the OpenID community and I thank them for all their efforts. They are, nevertheless, a company that must generate profits, and their recent invention of RPXNow is one attempt at doing that. It generates revenue for them: check. But is it really in your web site’s best interest to use RPXNow instead of using OpenID directly? I don’t think so. I have not

Remotely enable RDP

2009-01-08T10:06:00.001-08:00

Have you ever been away from your work PC, tried to Remote Desktop (RDP/mstsc) into it, only to realize that you’ve forgotten to enable RDP before you left work? Ever shake your head at the irony that if you could only remote in, you could enable RDP? Well now you can: Method 1 The simplest way is to run a free tool: http://www.intelliadmin.com/blog/2006/06/

OpenID on Classic ASP

2008-11-02T07:31:00.001-08:00

Several people have asked for an OpenID library for Classic ASP. Yes, it's several years deprecated, but there are still some major and smaller sites using it. Classic ASP allows the consumption of COM/ActiveX objects, so it turns out DotNetOpenId can be used by Classic ASP! But DotNetOpenId isn't a COM server. Not in its released form anyway. But there is now a CTP of DotNetOpenId that does