From Username & Passsword to "InfoCard"

Richard Turner - InfoCard Product Manager and Garrett Serack - Program Manager

AntiPhishing.org has stats on how many phishing sites there are.

InfoCard lets me use differetn identities at different web sites based on what information I want to give out.

InfoCard is PC based. MS is working on a device based solution.

Self issued cards are stored locally and not corroborated anywhere.

Managed cards are used by a trusted 3rd party. It doesn't contain any actual data, just the list of fields and a place to go to get the details.

InfoCard runs under a separate, restricted desktop.

Web site receives encrypted token and needs to decrypt it to get the information. This helps to protect against man-in-the-middle attacks.

InfoCard has basically 1 method called GetToken that you can program against.

With a managed card you have to authenticate to the STS (Secure Token Service) using a token, X509, Kerberos, hash, or user name and password. That will then get the data to put into the card to return back to the relying party.

Identity Metasystem - Standards based infrastructure for exchanging identity information across federated providers over the Internet.

Integrating with InfoCard

1 Update the database to associate a user with a card

2 Create an association page - Accept the info card

3 Update the sign in page

4 Update the registration page

IdentityBlog.com has code in PhP to accept InfoCard running on Apache.

WinFX which includes InfoCard wil be on Vista. There will be a deployment mechanism for XP and Windows 2003 Server.

Beta 2 coming soon with a release 2H06 (he said Q406).

You can import and export cards in v1 to synchronize between PCs. They are working on ideas of devices.

There is a commitment from the AD team to support STS in Active Directory. Until they create it Microsoft will ship code to integrate.

InfoCard v2 will support one time password generators.

There is not revocation mandated with v1. It is up to the issuer and possibly the trusting party to handle the revocation.

IIS7 as a Developer Platform

Thomas Deml - Lead Project Manager IIS

IIS7 ships on Vista and Longhorn server

Error support is better in IIS7 with a stack trace on the local machine. The messages are tied to a database that will evolve to give you better trouble shooting.

<system.webServer> tag in web.config to configure IIS settings.

New configuration GUI supports both ASP.NET and IIS settings.

New UI is completely remotable over HTTPS.

Extend IIS with C, C++, C# and VB.NET.

Use features of ASP.NET for different file types ie. Forms auth for jpeg.

IIS7 Ectensibiltiy - Class based C++ API or managed code implementing IHttpModule or IHttpHandler and can take advantage of built in features.

IIS7 has an ISAPI mode that provides compatibility with IIS6 Integrated mode puts the work from aspnet_isapi.dll directly in the pipeline. Configured at the application pool level.

IIS7 will ship on Vista including the home SKU. On the lower end SKUs only 10 requests will be processed concurrently.

Metabase is gone. Configuration loaded in process.

Build Your Next Generation Internet Site Using SharePoint Technologies 2007

Jackie Bodine - Program Manager - Windows SharePoint Services

SharePoint is an ASP.NET 2.0 application with master pages and all of the controls. You can plug in other ASP.NET 2.0 controls into SharePoint 2007.

There will be functionality for governance. Integration with WF to do workflow.

Page layout can be customized based on content type using master pages. You can have many layouts for a particular content type.

Will integrate with ASP.NET 2.0 web parts.

Content Query Web parts that integrate with RSS feeds so you can click on the web part and get the results as a feed.

Web services for the content and admin functionality.

Submitting content for approval will start an approval workflow.

UI provides "Item Pickers" to allow you to choose what you want to put in the content pages without having to write a lot of HTML.

Support for RSS on everything, Blogs, Wikis, and Discussion Boards

SharePoint 2007 supports multiple farms. You can have an authoring farm and from there push content out to the production farm. The users from the Internet only hit the production farm so any mistakes won't be visible to them.

Document Library and task list synchs to Outlook.

Pictures can be put in-line. The markup is "sanitized" based on the tags that Microsoft knows about. Any un-recognized tags will be removed.