Desktop applications and authentication... Is there a list of authentication options?

Question

Several sites, including this one, are using OpenID to authenticate their users. And of course, OpenID is a good solution to manage user accounts, simply by linking them to their OpenID account.

But are there similar solutions that could be used for desktop applications? I know there's CardSpace, where you create a custom ID card to contain your identity and optionally protect it with a pincode. But are there more alternatives for authentications on a desktop system or on systems within a local intranet environment?

And yes, I can write my own system where I keep a list of usernames and (hashed) passwords and then build my own login system but I just hate to invent my own wheel, especially when I need to keep it secure.

Answer 1

I would recommend that you look into the option of building an STS (using WIF, aka Geneva) and use (active) WS-federation in your windows app. Or if you can wait that long, just use Geneva Server when that is released.

Answer 2

We have a solution that works more or less like this:

1. Desktop tool prompts the user for ID/password
2. Desktop tool sends the ID/password over an encrypted (SSL) channel to the server.
3. Server initiates an HTTP request to a known URL of a login form and inputs the username and password as if they were form fields.
4. If the HTTP server responds appropriately, the server accepts the client as authenticated.

The target of that HTTP request should be tied to whatever single sign-on system that you use for the web application environment. In our case it happens not to be OpenID but it could be.