So far, we've added the ability to log in using an InfoCard. But how does the InfoCard get registered? Pretty simple: you add another <input> called "Register InfoCard", and invoke the same exact client script to pop up the InfoCard UI. Then, in the ASP.NET postback handler, you create a new entry in the siteSecurity.config file (which stores all the userid/password pairs for registered users), but add a "Pending" flag to the User structure to make sure the user entries aren't active until the user is validated, and a "PendingID" field to store the GUID that will be passed back in when the user clicks the validation link. First, the changes to SiteSecurity.cs. We add the fields mentioned above to the User class: public class User { string name; string password; // other fields omitted.. // true if the user is still being validated bool pending = false ; > Guid pendingID; // other properties omitted.. public bool Pending { get { return pending; } set { pending = value ; } } public Guid PendingID { get { return pendingID; } set { pendingID = value ; } } } And we add the following methods to class SiteSecurity: /// <summary> /// This function adds a user using a string containing the claims /// from a SAML token. /// </summary> /// <param name="claimString"> The claim string </param> /// <param name="id"> The id of the pending user validation request </param> /// public static void AddPendingUser( string claimString, Guid id) { Token token = new Token (claimString); string userName = GetUserNameFromToken(token); AddUser(userName, token.UniqueID, "commenter" , true , token.Claims[ ClaimTypes .Email], true , id); } /// <summary> /// This function approves a pending user validation request, without doing any validation /// on any incoming claims /// </summary> /// <param name="id"> The ID of the pending user validation request </param> /// <returns> A boolean corresponding to the status of the operation </returns> public static bool ApprovePendingUser( Guid id) { if (id != null ) { SiteSecurityConfig ssc = GetSecurity(); User user = ssc.GetUserByPendingID(id); if (user == null ) return false ; user.Pending = false ; SetSecurity(ssc); return true ; } return false ; } /// <summary> /// This function approves a pending user validation request provided /// that the claim string passed in matches the original claim string /// </summary> /// <param name="claimString"> The claim Read More...