JMPInline

DotNetOpenAuth’s “call home” reporting

2010-01-16T08:49:00.001-08:00

A few months ago I asked how people would feel if DotNetOpenAuth collected feature statistics and sent them back to the library's authors so we get a better feel for what features are used, errors that are common. The feedback I got was positive, so v3.4 has reporting turned on by default, but you can opt out either entirely or just omit certain details from the report by adding some simple tags

DotNetOpenAuth v3.4 now available

2010-01-15T15:20:00.001-08:00

You can go download DotNetOpenAuth v3.4 today. Highlights of the new version include: Support for Google Apps for Domains issued OpenIDs. This required special work since Google has their own flavor of OpenID discovery that had to be supported until something like Google’s scenario get’s standardized. Identifier discovery extensibility (this is how Google Apps support was enabled, but

Rest in peace, ExtremeSwank OpenID and OAuth

2009-12-08T12:12:00.001-08:00

ExtremeSwankOpenID and ExtremeSwankOAuth, both libraries authored by John Ehn, have been discontinued according to the project sites respective home pages which have a new note that reads: “Note: This … Consumer is no longer in development.” ExtremeSwankOpenID was stagnant in development lately, and when a recent OpenID vulnerability was identified as impacting the ExtremeSwankOpenID library due

DotNetOpenAuth v3.3 is released

2009-12-03T01:23:00.001-08:00

It’s been nearly six months since v3.2 was released. So what’s in v3.3 that took so long to bake? Well, a lot of it was waiting for and getting used to Code Contracts to mature enough to bet on the technology. The most exciting changes though are the new OpenIdSelector control, and the new project template that helps you get going fast and strong with a new web site that accepts OpenID and/

Feedback requested: New OpenID RP login UX prototype

2009-10-22T15:57:00.001-07:00

OpenID RP login UX Live demo location: http://openidux.dotnetopenauth.net/ Design considerations The DNOA login UX design document contains the design spec, and some of the reasoning that went into that design. One high-level goal of all this work is to produce a set of HTML, CSS, and JS files that can work on any web platform, so that ruby, python, php, coldfusion, and (of course) ASP.NET

Minify your EmbeddedResource .js and .css files in your MSBuild project

2009-10-10T15:57:00.002-07:00

If you write a C# or VB.NET class library that contains ASP.NET controls that also have .js or .css files embedded in your assembly, you probably want to minify those files for optimal download size in production, but keep the files readable for coding and debugging. What if you could add a single

VS2008 project template for OpenID and InfoCard relying parties

2009-10-09T11:22:00.001-07:00

I finally built a project template to make it easier to write an OpenID relying party web site using C# and ASP.NET. Up to this point all we had were the sample RPs that ship with DotNetOpenAuth, which were deliberately kept simple. They didn’t use a real database, didn’t follow some best practices, and weren’t very real. Now you can start your next web site with OpenID and InfoCard logins

Optimal OpenID UX finally underway

2009-09-25T21:47:00.001-07:00

I’m finally making progress on building a set of HTML and javascript files that can be used on any OpenID relying party web site to allow visitors to easily log in with OpenID, without even knowing what OpenID is. I mentioned my goal to do this some time ago, and now I have a small partially functional prototype. Please try it out, and keep coming back and letting me know what you think of it

How to easily fetch OpenID attributes, regardless of the Provider

2009-09-07T16:20:00.001-07:00

In a previous article, I bemoan the pain of writing an OpenID Relying Party that wants to fetch user attributes from their OpenID Provider, because of the at least 4 ways in which those attributes must be requested. And then later I promised that DotNetOpenAuth would offer help to alleviate that pain. That help has come. It actually came way back on June 26, 2009. But only now did I

DotNetOpenAuth v3.2 is done

2009-06-27T08:04:00.001-07:00

DotNetOpenAuth v3.2 just came off the presses. Lots of feature work and a few interop fixes in this release. The biggest highlights being: Very simple story for both RPs and OPs interested in interoperating with others whether they use sreg or one of the several AX formats (finally!) OAuth 1.0a support PPID generation for OPs to protect customers' privacy. Go download it. As

How to get ILMerge to work with .PFX files

2009-06-24T20:37:00.001-07:00

ILMerge is an excellent tool for “linking” multiple assemblies into one. But one of its switches, /keyfile:, which allows it to sign the resulting merged assembly, only accepts .snk files. It reports no error if you feed it a password-protected .pfx key-pair file, but the resulting assembly is invalid. >ilmerge /keyfile:some.pfx /out:merged\some.dll some.dll someother.dll >sn -v merged\

Help is coming for the Sreg/AX interop problem for OpenID

2009-06-20T07:23:00.001-07:00

Just to get your mouth watering for DotNetOpenAuth v3.2... V3.2 has a new "behaviors" plugin capability that lets RPs and OPs get additional functionality with very little effort. For example, OPs can add PPID identifier support very easily with just a few lines of code. But of most interest I suspect is the sreg/AX interop behavior, which if activated in your web.config file (1 line), will

Reverse engineering ASP.NET Membership passwords and salts

2009-06-12T15:49:00.001-07:00

I’m working on a project that was using the ASP.NET SQL Membership and I needed to remove the Membership provider from the system since we wanted more control over the user tables. Our existing users had passwords that ASP.NET Membership had hashed and salted, and we needed to be able to maintain those user accounts, which means we have to be able to validate logins against the salted passwords.

Caching results of .NET IEnumerable generator methods

2009-05-26T17:03:00.001-07:00

If you're already familiar with generator methods and want to jump to intelligent caching of their results, skip further down in this blog post. In C#, generator methods are methods that use yield return to return an IEnumerable

Uri.EscapeDataPath and HttpUtility.UrlEncode are NOT the same

2009-05-11T16:59:00.002-07:00

For some reason Microsoft defined URI escaping twice: Uri.EscapeDataString and HttpUtility.UrlEncode seem to cover the same need. There’s another pair: Uri.EscapeUriString and HttpUtility.UrlPathEncode which again seem to be redundant with each other. But in particular I found a small difference in behavior between the first two methods that should be called out.

Recent OpenID relying party vulnerabilities

2009-04-21T11:23:00.001-07:00

The OSIS I5 OpenID interop testing is well underway. Last weekend while testing some OpenID relying party web sites, John Bradley happened upon a web site that failed a particularly alarming test. Further investigation revealed that the security hole affected all OpenID relying parties based on Janrain’s Ruby OpenID library. Perhaps Janrain is using its Ruby library for RPXNow, because I

DotNetOpenAuth 3.0 released

2009-04-16T11:40:00.001-07:00

Download it now. Previously named DotNetOpenId in its v1.x and 2.x releases, the v3.0 release is rechristened DotNetOpenAuth to reflect its support for multiple authentication and authorization protocols. Sporting OpenID, OAuth and InfoCard support in its initial incarnation, it has been re-architected and largely rewritten to make adding more protocols fast and less error-prone. Even if you’

How to pretty much guarantee that you might get an email address with OpenID

2009-03-30T15:15:00.001-08:00

OpenID itself is just an authentication protocol. It takes OpenID extensions to get more information about the user like their name or email address. In fact there are two popular extensions that can provide this kind of information: Simple Registration (sreg) and Attribute Exchange (AX). A web site that wants to accept OpenID logins (this site is called a relying party, or “RP”) and also

Need access to that internal? Don’t touch that dial!

2009-03-16T13:10:00.001-08:00

The blessing and curse of open source is that the source can be easily changed. Internal types and members don’t need to be backward compatible with previous versions. This makes fixing bugs and feature enhancements much easier in future versions of the software. Making types and members internal cuts down on documentation that must be written, read and maintained. It protects callers from

DotNetOpenAuth 3.0 Beta 2 released

2009-03-11T20:47:00.001-08:00

DotNetOpenAuth, previously named DotNetOpenId, is getting nearer to its major 3.0 release. With beta 2, we have a security reviewed, feature complete library for .NET use of the OAuth and OpenID protocols. Although Beta 1 was very rough and was not recommended for use in production, Beta 2 has passed enough security, interop and stability tests to warrant live web sites to use this version.

Replay protection for OpenID 1.x relying parties

2009-03-07T21:34:00.001-08:00

If you’re writing an OpenID Provider, you should have a strong appreciation for the security of your customers’ identities that you will be protecting. One aspect of that protection is against replay attacks, where a man-in-the-middle sniffs the identity assertion from a Provider and replays it against the same relying party and manages to log in as the victim. OpenID 2.0 provides built-in

OpenID association poisoning

2009-03-07T21:14:00.001-08:00

As part of the OpenID protocol a relying party often establishes shared secrets (called ‘associations’) with identity providers that are used to verify identity assertions. It occurred to me that an OpenID relying party might easily introduce a major security hole in the process of establishing an association that could allow identity spoofing. Each association is assigned a handle, which is a

Fixing the OpenID login user experience

2009-02-28T19:35:00.001-08:00

The user experience of OpenID at Relying Party web sites is so important to get right. OpenID is right for your web site's visitors – no doubt in my mind about that. But we need to make sure it's very easy for your visitors to use so you don’t lose them when they've been pre-wired for the password anti-pattern. Several big companies like Yahoo and Google have invested a lot of effort into

DotNetOpenId v3.0 Beta 1 released

2009-02-04T22:21:00.001-08:00

Tonight DotNetOpenId, soon to be renamed DotNetOpenAuth, released beta 1 of the major v3.0 release. You can download the bits from Ohloh. Although downloads should remember that as a beta this version should not be used in production, there are several new features that should be worth investigating and building a web application around while the final release is still in development: OAuth

DotNetOpenId is looking for a new home

2009-02-02T07:00:00.001-08:00

DotNetOpenId started on Google Code. But we’re outgrowing it. We’d like to move to a shared hosting server where we can have automated tests, nightly builds, and a better web site and online documentation. This new web site will cost real money though, which is beyond my FOSS-hobby budget. Please if you like DotNetOpenId, consider making a donation toward making this happen!