Recently in Identity Management Category

Back to school time for IT staff at libraries usually involves a handful of new databases to configure and an updated version of EZproxy access and authentication software. This year is no different: the latest version (5.2) is now available. A snippet of the enhancements going on in this release:

• New directive for use in LDAP authentication, which allows the search filters that are used in login to also be used when reading attributes.
• EZproxy now allows vector notation in the user.txt file, to give III systems more flexibility with contact information.
• The sample config.txt updated to include more stanzas for OCLC resources, so it's easier and faster to add a new database to your configuration file.
• See the full list and get the details on all the 5.2 changes.

If you have specific questions about your installation, the EZproxy listserv is usually a good first step.

Information Cards introduce a new paradigm in on-line authentication that replaces conventional Username and Password login. The new paradigm is based on the very familiar 'real world' experience of presenting credentials. When I want to purchase something and I don't have cash; I present a credit card. When I want to rent a car I pull out my driver's license and when I want to borrow a book from the library I pull out my library card. Despite the number of cards I may have in my wallet; 3 credit, 1 debit, healthcare, dental care, library, 3 museum memberships, 2 frequent flyer, etc... It is very easy and intuitive for me to select the right card at the right time.

The mechanics of trust that 'real life' cards represent is also interesting. When I present my driver's license, the 'claims' on the card; age, address, etc... are packaged in such a way that the person looking at the card can establish 'trust'. They can compare the picture on the card to my face. They can compare the age represented on the card to their view of how old I am; they can compare the eye-color listed to my eyes. Finally, they can identify the state that issued the card. The trust mechanics dictate that:

The card does not appear to have been tampered with. The photo to face matching indicates that this card was issued to this person by the State of California. I trust the State of California I can therefore trust the claims on this card.

The interesting thing to note is that there is no need for trust to be established between the person presenting the card and the person accepting the card. The person accepting the card only has to trust the State that issued the card; even though the state isn't present, or in any way involved in the transaction. This is similar with credit card processing; a shop keeper doesn't trust you to give them money 'later' ("I'll gladly pay you Tuesday for a hamburger today"), but they do trust Visa, the issuer of the card.

Information Cards bring this paradigm and these mechanics to our online experience. When you login to a web site with Information Cards (I-Cards) you are asked to select an I-Card from your virtual wallet. The analogy isn't perfect so the wallet, otherwise known as; The Card Selector, has some smarts to make things easier.

The Card Selector, which is a piece of 'secure' software running on your machine, remembers places that you have logged in before. Each time you start to log into a site that you haven't logged into before, you get an informational dialog that tells you about the site you are logging into. This largely eliminates concerns about 'phishing' attacks, scams where a site pretends to be a site it's not to get your username and password. Even if a site manages to fool you into logging in with an I-Card ; they don't get something they can use somewhere else.

When you click on the 'login' link, the site you are trying to log into tells your computer what it wants to know about you. If you are trying to leave a blog comment that might just be a nickname, if you are trying to purchase beer it might be a claim that you are over 18 years of age. When the wallet opens, only those cards that are capable of satisfying the sites 'policy' (what the site wants to know) are selectable. This interaction means that the user doesn't have to go through and select from ALL their cards every time they login, the choice comes down to selecting from one or two for any given context; Visa or American Express?

If you want to play with Information Cards the best place to start would be http://www.azigo.com/icards.html this site is provided by Parity Inc.; THE leaders in implementing this technology. If you click through the Equifax Card sign-up process you will have the Card Selector installed and get your first i-Card, one that can 'prove' you are over 18 (if you are) without exposing any other information about you. The Minuteman Library Network is the first Library Card i-Card project and probably of special interest to the readers of this blog; I am working on this project and will keep you informed of its progress.

One of the hottest issues in Identity Management is often referred to as SSO; Single Sign-On. However it is a horribly misunderstood and misused term. I will try to give a brief overview of what SSO is and isn't.

What most people mean when they say SSO is the user experience of accessing multiple services and systems but only having to 'log-in' once. On the face of it SSO sounds great but there are some pitfalls that we have to be wary of. If we aren't very careful, the 'ease' of SSO is bought at the cost of privacy.

The type of SSO that I am going to explore is the "HTTP Redirect" SSO mechanisms that are widely deployed for SSO on the web. This includes OpenID, Shibboleth (Web SSO), SAML (WebSSO), FaceBook, Yahoo! and Google, to name a few. These protocols differ in many details and have different strengths and weaknesses but they all share the same underlying HTTP Redirect mechanism. The basic pattern is this:

1. Jane navigates to a web-site and she wants to log-in using a username and password that support SSO.
2. Jane clicks on the 'login' button on the page.
3. Jane has to tell the web-site who her SSO service provider is. This is known as the Where Are You From problem, otherwise known as WAYF. More about WAYF in a moment.
4. Once Jane has told the web-site who her SSO service is; a HTTP Redirect is sent to the browser to send Jane off to her SSO service.
5. At her SSO service Jane is asked to provide her UserName and Password.
6. If Jane convinces the SSO service that she is, in fact, Jane, then she is returned (via HTTP Redirect) to the original web-site with a 'token' that says "I am SSO service XYZ and I believe this is Jane"
7. The web-site and SSO service communicate in such a way that the web-site can validate that this is really SSO service XYZ talking AND if it knows and trusts service XYZ it can go ahead and accept that this is Jane.
At this point we have performed 3rdParty Authentication or Federated Sign-On NOT SSO.

8. Having done what she came to do Jane now navigates to another web-site.
9. When Jane arrives at the second web-site she is NOT recognized as being logged in. This site has no knowledge who she is or that she has logged in somewhere else before. If Jane wants to access 'protected' resources at this web-site she is going to have to click on the log-in button.
10. Again Jane will be asked Where Are You From and she will select her SSO service provider.
11. The web-site will then send Jane off to her SSO provider asking... "Who is this?"
12. Because Jane logged into her SSO service just a few minutes earlier the SSO service doesn't ask Jane for a UserName and Password this time, it immediately returns back to the web-site with a 'token' that says "I am SSO service XYZ and I believe this is Jane"
13. The using the same trust validation as above the web-site can now believe that this is Jane

And Jane only logged in ONCE... that is SSO.

Jane still had to click on login twice and still had to provide her SSO service twice but she only Signed-On a Single time.

There are variations in this flow, OpenID nicely shortcuts the double SSO service provider selection BUT you have to type in your UserName twice.

The most common expectation of SSO that is not satisfied by the flow described is "why didn't the second site just 'know' that I had already logged in and who I was?" Apart from the fact that would be technically difficult the answer is actually that REALLY you wouldn't want that behavior... Once I explain why:

If SSO worked that way, when you logged in once, everywhere you went on the internet would know who you are. Not just an IP address, they would be getting a message "here's Jane". All of the web-sites on the web could talk to each other and work out EXACTLY which sites you visited and which ones you didn't. That is generally considered to be a terrible breach of privacy. In order to avoid this privacy leak clicking 'login' remains an explicit action that the user must take. The action no longer means: "I want to enter my username and password" but now means "I'm OK telling this site who I am."

There are ways for 'closely connected' sites to shortcut this experience. Handing a user from their Local Library System to the Consortia Meta-Search interface; a handoff that is between trusted parties; Janes identity CAN be passed from one service to the other providing the 'seamless' SSO that we would love to have. But you can't be sure that Jane was OK being identified at the second system unless you make the action explicit. As a service provider you have to make very careful choices between seamless SSO and user privacy.

Rather than going on now:- You can tune in later for "SSO using Pair-Wise Identifiers to protect your privacy", "How and Why OpenID is different from Shibboleth Web SSO" , "Why you MUST trust your SSO service provider because they know a lot about you"...

Please ask questions if I haven't been clear... Please let me know if you think I have said something misleading or wrong... I'm just trying to start a conversation here.