Joe Poon

At the Burton Group Catalyst Conference in San Francisco last week, I had the pleasure of tending a booth in Microsoft’s Hospitality suite to spread the good word about Information Card Ruby. The booths centered on the theme of identity, with great representation from companies and leaders in this space. The excitement and activity around information cards was quite inspiring. For instance, I had an interesting discussion with a participant from the insurance industry whose clients are primarily senior citizens. The intuitive nature of the information card experience is of interest, as providing an information card from your identity selector at a website closely parallels the real world scenario of providing a piece of ID from your wallet at the supermarket. Moreover, one less username + password to remember not only appeals to seniors, but myself included! There was also interest from a wide spectrum of organizations, including a college administrator who was interested in the applicability of information card authentication for his students and staff. Many others wanted to understand more fully managed card scenarios and wished to see major sites adopting information cards. Understandably so, when more major sites adopt information cards it will provide the confidence, knowledge and momentum for other interested parties to follow. Having said that, there are impressive sandbox/demo sites available to give users a feel for the information card experience, including the nicely done Fabrikam Friends. And finally, I was impressed by Gemalto’s booth which showcased a modified Windows CardSpace client to store your information cards on a smart card. This allows you to take your information cards with you wherever you go. Kim Cameron, which I had the pleasure of meeting at Burton, nicely summarizes Gemalto’s offering here. Overall, the activity and curiosity around information cards was great to see – definitely interesting times in the identity space.

We are pleased to release Information Card Ruby 0.1.0. Information Card Ruby is an open source project which provides a plugin and gem for integrating information card authentication to your Ruby on Rails web application. The gem does the heavy lifting of decrypting, processing and authenticating information cards, while the plugin supplements your rails application with useful methods to start accepting information cards.

So, Information Card Ruby enables your Rails website to authenticate users with information cards. Sounds great you say, but you may be wondering “what is an information card?”, “where do users get information cards come from?” and “how do users select and provide information cards to my website?” Good questions. An information card is essentially a digital identity which contains claims that relate to you. For instance, I have an information card that claims my first name is Joe and that I live in Canada. As for who issues cards, there are two types of cards, namely personal and managed. Personal cards are created by you and are stored on your local machine. For instance, on Windows, you may use Windows CardSpace to create a personal information card with details such as your name and e-mail. Managed cards are obtained from Identity Providers, which are third parties whom can truly attest to your identity, such as your bank or employer. As Information Card Ruby 0.1.0 only supports personal cards at the moment, we’ll delve into managed cards another day. Alright, at this point we know what an information card is and how we can create our own personal cards. Now, it’s time to find a website to put this card to use. Conveniently, we have a demo site which has integrated the popular forum Beast with Information Card Ruby. If you visit our demo site, you can sign up and login with your information card.

On the demo site, if you click on the shiny red card icon, it will invoke an Identity Selector. For you Windows Vista (or XP with .NET 3.0 runtime) users, this will trigger Windows CardSpace. Not on a Windows machine? No worries, there are non-Windows and non-Internet Explorer specific selectors available for download. The Identity Selector retrieves the policy (ex. the required claims) of the website and pops up a GUI showing you a list of your information cards that would work for the given policy. For example, the demo site has been setup to require the claims {given name, surname, email}. Only your cards which provide a subset of these claims can be used for authentication at the demo site. With the Identity Selector, simply select one of your qualifying cards to be sent to the website for authentication. And that’s it, you’re done!

Well, that’s a brief overview of where Information Card Ruby fits in within the information card metasystem. Excited? Great. From the project home page, you can read the documentation, try the demo and download the code from rubyforge. To learn more about Windows CardSpace, visit cardspace fx. The Information Card Ruby team (Jason Sallis, Vijay Rajagopalan and Joe Poon) truly welcomes your feedback.