This article includes a list ofgeneral references, butit lacks sufficient correspondinginline citations. Please help toimprove this article byintroducing more precise citations.(July 2011) (Learn how and when to remove this message)

Windows CardSpace
The Windows CardSpace user interface, showing card creation template example
Developer	Microsoft
Operating system	Microsoft Windows
Successor	U-Prove
Service name	Windows CardSpace (idsvc)
Type	Identity management system

Windows CardSpace (codenamedInfoCard) is a discontinuedidentity selector app byMicrosoft. It stores references todigital identities of the users, presenting them as visualinformation cards. CardSpace provides a consistentUI designed to help people to easily and securely use these identities in applications and web sites where they are accepted. Resistance tophishing attacks and adherence toKim Cameron's "7 Laws of Identity"^[1] were goals in its design.^[2]

CardSpace is a built-in component ofWindows 7 andWindows Vista, and has been made available forWindows XP andWindows Server 2003 as part of the.NET Framework 3.x package.

When aninformation card-enabled application or website wishes to obtain information about theuser, it requests a particular set of claims. The CardSpace UI then appears, switching the display to the CardSpace service, which displays the user's stored identities as visual cards. The user selects a card to use, and the CardSpace software contacts the issuer of the identity to obtain adigitally signedXML token that contains the requested information. CardSpace also allows users to createpersonal (also known asself-issued) information cards, which can contain one or more of 14 fields of identity information such as full name and address. Other transactions may require amanaged information card; these are issued by a third-partyidentity provider that makes the claims on the person's behalf, such as a bank, employer, or a government agency.

Windows CardSpace is built on top of theWeb services protocol stack, an open set of XML-based protocols, includingWS-Security,WS-Trust,WS-MetadataExchange andWS-SecurityPolicy. This means that any technology or platform that supports these protocols can integrate with CardSpace. To accept information cards, aweb developer needs to declare anHTML<OBJECT> tag that specifies the claims the website is demanding and implement code to decrypt the returned token and extract the claim values. If an identity provider wants to issue tokens, it must provide a means by which a user can obtain a managed card and provide aSecurity Token Service (STS) which handlesWS-Trust requests and returns an appropriate encrypted and signed token. During the 2000s, identity providers that didn't wish to build STS could obtain one from a variety of vendors, includingPingIdentity,BMC,Sun Microsystems,Microsoft, orSiemens.

Because CardSpace and the identity metasystem upon which it is based are token-format-agnostic, CardSpace did not compete directly with other Internet identity architectures likeOpenID andSAML. These three approaches to identity can be seen as complementary,^[3] because during the 2000s, information cards could be used today for signing into OpenID providers,Windows Live ID accounts, and SAML identity providers.

IBM andNovell planned to support^[4] theHiggins trust framework to provide a development framework that includes support for information cards and the Web services protocol stack, thus including CardSpace within a broader, extensible framework also supporting other identity-related technologies, such asSAML andOpenID.

Microsoft initially shipped Windows CardSpace with the.NET Framework 3.0, which runs onWindows XP,Windows Server 2003, andWindows Vista. It is installed by default on Windows Vista as well asWindows 7 and is available as a free download for XP and Server 2003 viaWindows Update. An updated version of CardSpace shipped with the.NET Framework 3.5. The new Credential Manager in Windows 7 uses Windows CardSpace for the management and storage of saved user credentials.^[5]

On February 15, 2011, Microsoft announced that Windows CardSpace 2.0 would not be shipped.^[6] Microsoft later worked on a replacement calledU-Prove.^[7]

• Information Card
• Higgins project
• Shibboleth (Internet2)
• Identity management systems
• Windows Hello

Software development

• Windows CardSpace on .NET Framework documentation site – Developer articles and technical documentation on Windows CardSpace
• Microsoft Information Card Kit for ASP.NET 2.0 – ASP.NETRelying Party (RP) code to support CardSpace
• Microsoft Information Card Kit for HTML – platform-independent JavaScript and CSS code that detects if the client can use i-cards and provides the corresponding UI support
• Open sourceRuby RP code for accepting information cards
• Open sourceJava RP code for accepting information cards
• Open sourceC and PHP^{[permanent dead link]} RP code for accepting cards
• Open sourceC RP code for accepting information cards andSTS code for managed i-cards
• Open sourcePHPArchived 2007-11-12 at theWayback Machine Security Token Service code for managed cards
• Open sourceC#Archived 2013-06-16 at theWayback Machine STS code for managed information cards

Identity selectors

• Digital MeArchived 2012-01-13 at theWayback Machine – an open-source Identity Selector forLinux andMac OS X
• A plug-inArchived 2006-11-07 at theWayback Machine for Apple'sSafari implementing an Information Card identity selector
• A plug-in forFirefox to activate CardSpace and other identity selectors

Blogs

• Kim Cameron's Identity Weblog – Blog from Microsoft's architect for identity
• Mike Jones: Self-Issued – Blog on CardSpace, cards, and digital identity from Microsoft's Director of Identity Partnerships
• Vittorio Bertocci (archived) – Blog on designing and developing with CardSpace from Microsoft's architect evangelist for Windows Server 2008
• Claim-Based Identity Blog (archived) – Blog on CardSpace from its development team

• Identity management
• .NET software
• Web services
• Federated identity
• Discontinued Windows components

• Articles with short description
• Short description matches Wikidata
• Articles lacking in-text citations from July 2011
• All articles lacking in-text citations
• All articles with dead external links
• Articles with dead external links from May 2023
• Articles with permanently dead external links
• Webarchive template wayback links