Article ID: 969419 - Last Review: March 31, 2009 - Revision: 1.0 PPID information and generation examplesOn This PageINTRODUCTIONThe Private Personal Identifier (PPID) claim provides a site-specific identifier for both managed cards and self-issued cards. The PPID is a unique identifier that is generated from information about the recipient and from information in the card that is being used. When you use the same card at a different relying party, a different PPID is generated.
This article provides examples of how CardSpace generates the PPID value for self-issued cards, the Signing Key value for self-issued cards, and the Client Pseudonym value that identity providers can use to generate the PPID value for managed cards. A concise description of the algorithm can also be found in Section 8.6.1 of the Identity Selector Interoperability Profile V1.5 document. To view this document, visit the following Microsoft Web site: http://download.microsoft.com/download/1/1/a/11ac6505-e4c0-4e05-987c-6f1d31855cd2/Identity_Selector_Interoperability_Profile_V1.5.pdf
(http://download.microsoft.com/download/1/1/a/11ac6505-e4c0-4e05-987c-6f1d31855cd2/identity_selector_interoperability_profile_v1.5.pdf)
MORE INFORMATIONPPID for self-issued information cardsThe PPID value is derived from the following two computed intermediate results:
Computing the RP_PPID_Seed valueThere are a few different ways that the RP_PPID_Seed is generated, depending on the answers to the following questions:
Non-SSL connection (HTTP)If the request is not over a Secure Sockets Layer (SSL) connection (that is, if the request is over HTTP), the RP_PPID_Seed value is the SHA256 hash of the Unicode lowercase host name.For example, the request may come from the following URL: http://relyingparty.federatedidentity.net/AnyIssuerRelyingParty/Login.aspx
(http://relyingparty.federatedidentity.net/AnyIssuerRelyingParty/Login.aspx)
In this case, the host name is the following:relyingparty.federatedidentity.net When the host name is encoded into a byte array, the host name is the following:Collapse this table
QwgpRkiNa+KNxOuavZVUpcP0qqWqJsv0Tvrut3GHQkI= (base 64) Collapse this table
The SSL certificate organization is specifiedIf the SSL certificate has a specified Organization (O), the RP_PPID_Seed value is the SHA256 hash of the following formatted string:|O="{___}"|L="{___}"|S="{___}"|C="{___}"| The attributes come from the certificate. For example, the certificate may contain the following attributes:
|O="Microsoft"|L="Redmond"|S="Washington"|C="US"| The computed RP_PPID_Seed (using SHA256) value is the following: uVb7rHS3H+JrwtTdh32g0I89ldzy/hED93BpSvPpz4w= (base 64) Collapse this table
|O="Microsoft"|L=""|S=""|C=""| The computed RP_PPID_Seed value (using SHA256) is the following:TSiUPtfHYOymhbnFTqM05pFrxkRVzBdW4+sqwB5Kgbg= (base 64) Collapse this table
The SSL certificate organization is not specified but common name is specifiedIf the SSL certificate does not have a specified Organization (O), but the SSL certificate has a specified common name (CN), the RP_PPID_Seed value is the SHA256 hash of the following formatted string:|CN="{___}"| In this formatted string, "{___}" is replaced by the value of the CN. For example, if the SSL certificate is issued to relyingparty.federatedidentity.net, and the certificate does not specify the Organization (O) attribute, the formatted string is the following:|CN="relyingparty.federatedidentity.net"| The computed RP_PPID_Seed value (using SHA256) is:A2Qy5dkoyNT8bhLbO6+k3pW0vg6VEaUfm8ZdBZnRgMg= (base 64) Collapse this table
The SSL certificate organization and common name are not specifiedIf the SSL certificate does not have a specified Organization (O) and does not have a specified Common Name (CN), the RP_PPID_Seed value is the SHA256 hash of the certificate's public key.Computing the CardId_Hash valueThe CardId value is a randomly generated unique Uniform Resource Identifier (URI). The CardID value is used to uniquely identify a card. PPID needs the SHA256 hash of the CardId value.For example, you may use the FedId Self-Issued card. The FedId Self-Issued card resembles the following: Collapse this image urn:uuid:dde7d341-cb77-4e2f-afcd-d4fddc3ba6fb When the CardId value is encoded into a byte array, the CardId value is the following:Collapse this table
+8xmlVK/Qe9jHz0paZuKUwIwPBUan1UGfh1KSk9cFc8=(base 64) Collapse this table
Generating the PPIDTo generate the PPID, concatenate the two byte arrays (that is, the RP_PPID_Seed byte array followed by the CardId_Hash byte array) to form a 64-byte array.For example, the request may come from the following URL: http://relyingparty.federatedidentity.net/AnyIssuerRelyingParty/Login.aspx
(http://relyingparty.federatedidentity.net/AnyIssuerRelyingParty/Login.aspx)
If you are using the FedId Self-Issued card from the OSIS "Selector Constructs Site-Specific Identifiers for Self-Issued Cards" interop test, concatenating the value of the RP_PPID_Seed byte array and the value of the CardId_Hash byte array results in the following byte array:uVb7rHS3H+JrwtTdh32g0I89ldzy/hED93BpSvPpz4z7zGaVUr9B72MfPSlpm4pTAjA8FRqfVQZ+HUpKT1wVzw= (base 64) Collapse this table
WvA5Huo0c265eAuMu0rW6XF48ghQ+cZ5Osyb+vFhMg8= (base 64) Collapse this table
Computing the friendly PPIDThe friendly PPID is a ten-character alphanumeric representation of the PPID. The friendly PPID is more readable to the user. The friendly PPID is based on the following character map:QL23456789ABCDEFGHJKMNPRSTUVWXYZ To compute the friendly PPID, follow these steps:
Signing key for self-issued information cardsThe signing key is used to sign the self-issued tokens that are generated.The signing key is based on the following information:
Master KeyThe master key is dynamically generated when a self-issued card is first created. The master key remains the same when the card is backed up or roamed.Computing RP_IdentifierThe recipient identifier for PPID, RP_PPID_Seed, is generated in a similar way as the recipient identifier for organization (RP_Identifier). However, the computation for the RP_Identifier value distinguishes between extended validation (EV) certificates and regular SSL certificates.Non-SSL connection (HTTP)The RP_Identifier value is the same as the RP_PPID_Seed value.The SSL certificate organization and the common name are not specifiedThe RP_Identifier value is the same as RP_PPID_Seed value.The SSL certificate organization is not specified, but the common name is specifiedThe RP_Identifier value is the same as RP_PPID_Seed value.The SSL certificate organization is specifiedIf the certificate is an EV certificate, the RP_Identifier value is the same as RP_PPID_Seed value.If the certificate is a regular SSL certificate, the RP_Identifier value is the SHA256 hash of the following formatted string, where the attributes come from the certificate: |Non-EV|O="{___}"|L="{___}"|S="{___}"|C="{___}"|
For example, the certificate may contain the following attributes:
Collapse this table
For example, if the certificate only contains the "O = Microsoft" attribute, the formatted string is the following: |Non-EV|O="Microsoft"|L=""|S=""|C=""|
In this case, the computed RP_Identifier value (using SHA256) is the following:
Idca8yDKKAN0RpzxTLeEjr2MZ4DPXllJk/7EQpq8dPw= (base 64) Collapse this table
Generating the signing keyTo generate the signing key, follow these steps:
Client pseudonym for managed information cardsThe client pseudonym is extra information that is passed to the IPSTS when one of the supported claims in the card is the PPID.The client pseudonym is computed based on the following information:
The master key and hash salt of the managed cardBoth of these data values are dynamically generated when a managed card is first installed. They remain the same when the card is backed up or roamed.RP_PPID_Seed for client pseudonym calculationThe RP_PPID value is calculated for managed cards in the same manner as for self-issued cards. For an example of this computation, see the "Computing RP_PPID_Seed" section.Generating the client pseudonymTo generate the client pseudonym, concatenate the three byte arrays. The master key is followed by the RP_PPID_Seed value. The RP_PPID_Seed value is followed by the hash salt.Collapse this image https://relyingparty.federatedidentity.net/CardSelectorRP/login.aspx
(https://relyingparty.federatedidentity.net/CardSelectorRP/login.aspx)
If you use the Echo Non-Auditing card from the OSIS "Selector Support for Non-Auditing Cards" interop test, the following data is generated:
iXAQ7TSku+L21Af2QNvRhTbiaSTLu6md4u3neRhlONe5VvusdLcf4mvC1N2HfaDQjz2V3PL+EQP3cGlK8+nPjF7pcCKG+D+nzr/edg28t9U= (base64)
Collapse this table
In this example, the generated client pseudonym (using SHA256) is the following: dOcmDC6vbrrbIC/lwCCxpI6RiVefHHukiAqpkD7jptA= (base 64)
Collapse this table
For more information about the "Selector Constructs Site-Specific Identifiers for Self-Issued Cards" OSIS interop test, visit the following Web site: http://osis.idcommons.net/wiki/I5:FeatureTest-Selector_Constructs_Site-Specific_Identifiers_for_Self-Issued_Cards
(http://osis.idcommons.net/wiki/I5:FeatureTest-Selector_Constructs_Site-Specific_Identifiers_for_Self-Issued_Cards)
For more information about the "Selector Support for Non-Auditing Cards" interop test, visit the following Web site:http://osis.idcommons.net/wiki/I5:FeatureTest-Selector_Support_for_Non-Auditing_Cards
(http://osis.idcommons.net/wiki/I5:FeatureTest-Selector_Support_for_Non-Auditing_Cards)
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
| Article Translations
|
Back to the top
