Policy Server Guides › Policy Server Configuration Guide › Authentication Schemes › Information Card Authentication Schemes › SiteMinder Information Card Authentication Scheme (ICAS) › ICAS Terms

ICAS Terms

The following terms are useful for understanding ICAS:

• Identity Metasystem

  An architecture that specifies how identity information can be shared by users, Relying Parties, and Identity Providers.

• User

  The person whose identity information is being shared. Sometimes, the user is called the subject.

• Relying Party (RP)

  The Web site that requests and consumes identity information.

• Identity Provider (IdP)

  A third party that authenticates identity information and shares the information with Relying Parties by creating security tokens. Credit card companies, banks, government agencies, employers, and insurance companies are all examples of Identity Providers.

• Security Token Service (STS)

  The technology used by Identity Providers to create security tokens. A Security Token Service:

  • Authenticates users
  • Creates security tokens that
    • Contain different subsets of identity information, depending on the requirements of the Relying Party and the restrictions of the user
    • Are of different types

      Note: SiteMinder supports SAML 1.0 and 1.1.

    • Are encrypted for security and signed for authenticity and integrity
• Security Token

  A cryptographically signed and encrypted set of claims.

• Claim

  An assertion of truth. Each token contains one or more claims about the user's identity. Examples of claims are first name, last name, email address, birth date, and so on. Claims can be made by the user or a third-party Identity Provider.

• Information Card

  A set of identity information. Information cards are comparable to the physical cards that we carry in our wallets. For example, an information card that corresponds to a driver's license might contain the following sensitive identity information: photo, birth date, first and last name, driver's license number, state, height, and sex.

• Personal Card

  An information card that contains claims that the user asserts about himself, but that are not corroborated by a third party. A personal card contains a Private Personal Identifier (PPID) that is generated when the card is created. Personal cards are appropriate for low-sensitivity identity information, such as an email address.

  Note: Personal cards are also called self-issued cards.

• Managed Card

  An information card contains claims that the user asserts about himself and that are corroborated by a third party. A managed card contains a Private Personal Identifier (PPID) that is generated when the card is created and a pointer to the Identity Provider's STS. Managed cards are appropriate for sensitive identity information, such as a credit card number.

• Identity Selector

  An application that lets users manage their relationships with Relying Parties and Identity Providers and control how their identity information is shared and used. An identity selector:

  • Enables sharing of information between parties that use multiple communication protocols and security technologies
  • Provides a consistent user interface across multiple Identity Providers and Relying Parties using information cards
  • Highlights those information cards that are available for each exchange of identity information
  • Lets users view and consent to sharing identity information
• Windows CardSpace

  Microsoft's Identity Selector for the Windows operating system.

• Information Card Authentication Scheme (ICAS)

  Support for Windows Cardspace, Microsoft's Identity Selector, implemented in SiteMinder as a custom authentication scheme.

• Private Personal Identifier (PPID)

  Identifier generated by the Identity Selector when an information card is created.