Vittorio Bertocci, Garrett Serack, Caleb Baker
"Understanding Windows CardSpace: An Introduction to the Concepts and Challenges of Digital Identities"
Shouldn??™t the site know what kind of card it wants
ahead of time? This is true if the site accepts cards from a single issuer, but becomes
harder in some multi-issuer cases. If the site allows employees from company
A and company B to log on to their site, it is possible that users will ?¬?rst be
asked to select which company they are coming from on the website. This lets
the site update its policy, dynamically, to match cards from that company.
Another way to solve this problem is if company A and company B have a
unique claim type, such as http://claim/type/friendsOfCompanyC, this claim
could be requested, and issuer left blank. That way both company A and company
B cards would match the requested policy, whereas other cards wouldn??™t.
Of course, that requires cooperation between all the companies involved,
which might be impractical.
Using CardSpace in the Browser 233