Hi all,
Can anyone explain what is sent by CardSpaceUI to the STS server?
That request is encrypted or is a plain message?
Im trying to get the content of the message, but it seems impossible...
Thanks alot!
First of all, the claim(s) request is sent with a list of claims. The identity of the RP may or may not be sent depending of if the STS requires it and/or the RP wants it to be or not.
A good document to read over if you're interested in the messages would be:
http://www.identityblog.com/wp-content/resources/profile/Infocard-Profile-v1-TechRef.pdf
The request is encrypted based on the encryption method specified by the STS.
As for getting the content of the message, it may be easier to do so on the STS side.
//Toland
Thanks for your response,
However, my question focus more on C# ..
...
For the class Message in System.ServiceModel.Channels, when the CardSpaceUI makes a request to STS, it generates a message, right?
So, my question is, "is that message encrypted over the internet connection ?" Since I try to catch the value of the message (should be in SOAP format) but impossible..
If it is encrypted, how can we decrypt it? If not so, how can we catch the message..
Regards,
Alex
I would suggest to play with the Simple STS sample and it should give you enough insight to continue. The content sent between CardSpace and the STS is encrypted and and the encryption/decryption process depends on how it's defined by the policy.
//Toland
that points to the mex of your STS so applications connecting to it will its policy and what it supports.
//Toland
Is it encrypted ?
Since it is a kind of message, what is the format of the message sent from mexAddress?
It's encrypted with the https protocol, but otherwise it's pretty much open.
You can take a look at:
https://sts.labs.live.com/identity/ws/mex
Everything else about the mex, you'd probably have to read it in the documentation.
//Toland
Thanks Hon,
However, the link seems to be inaccessible, the error is : the requested site is unavailable or can not be found..
try opening that in a different browser or use wget or curl. ie seems to automatically redirect to a non-existing page for some reason.
//Toland
