|
|
Browse by Tags
All Tags » Infocard » Wild Ideas (RSS)
-
You would not believe how often I have to set up identity enabled web sites: for verifying a theory, for proving a point with colleagues, for demos and events... really really often. Vast majority of cases those are barely proofs of concept, nothing elaborated, so I've been working for reducing the overhead that every project entails. Needless to say, Zermatt has been a miracle balm for this: instead of cut&paste reuse, I finally have a tool with most of the capabilities I need few intellisense steps away. However my laziness knows no boundaries, so I came out with something that's even faster: a Visual Studio template for web sites, which sets up the few knobs that Zermatt needs directly at project creation time. Oh, don't expect anything fancy: this is basically the RP project I walked you through few posts ago . The only difference is that instead of adding references, creating pages, dragging controls and working with the web.config the template itself takes care of that. I am providing the template as attachment to this post : you can just drop the ZIP it in C:\Users\<your user>\Documents\Visual Studio 2008\Templates\ProjectTemplates\Visual Web Developer (or equivalent, if you use another disk/OS) and next time you'll create a new web site with Visual Studio you'll find it under "My Templates" as shown below. Now. ALL possible disclaimers apply for this template, the web site produced is just an example and lacks A LOT of key capabilities that should instead be Read More...
|
-
(continues from Part I and Part II ) Finally we've lined up all the elements we need for understanding how we can get rid of the 1-2-3 tyranny, and deal with our business requirements directly instead of relying on an old model that forces us to perform unnecessary steps and introduces artificial dependencies. For making sense of what I write in this post you *really* need to read part I and II as well; without the right context, some of those things could be badly misinterpreted. Sorry :-) Outsourcing user authentication As much as I'd like to think that everybody is super interested in authentication, reality is that you may care very little about it. Let's say you are hosting your own blog, and comment spammers harass you. You can make their life more difficult by adding an authentication step, that will ask your readers to sign in before being able to comment. That's not a perfect system, but you know... security is a ladder. If you discouraged 70% of the spammers, you already made a great job. Or did you? Now you need to set up the authentication system, and above all maintain it. That means handling lost passwords; attacks to your credentials store, which may (read: will) contain passwords (well, hopefully hash derivations) your users are reusing with websites which feature higher value transaction; and many other annoyances. The blog example is a bit extreme on the low value gamut, but there are many other situations in which owning direct credentials authentication may Read More...
|
-
(continues from Part I ) You can consider this post and the fine grained analysis we made in Part I as a down payment for grasping the implications we'll see in Part III, which I plan to post in few hours (almost done). I was planning to have just 2 parts, but it came out far too long and I need 3 :). Here we'll see a very general architecture that can support the traditional authentication practice we described so far. Let me refresh your memory with those few key points we established last time: When we feel the need of authenticating users before giving access to our application, usually that's because we need the answer to some questions in order to execute correctly the service we are offering The question "are you a returning user" can be verified directly by using some mechanism, such as asking to the user to submit credentials . For almost all other questions we need to get an answer that satisfies us without a chance of verifying it directly in-band (messy, but if you read part I you'll understand) When we authenticate a user in "traditional" way, we essentially do three distinct things at the same time: We answer the question "are you a returning user?" by verifying the credentials We link the credentials to a profile in our archive We "dehydrate" that profile, and we use its content for answering our other questions We'll now review what are the architectural components that we customarily use for traditional authentication, that is to say what do we need for performing Read More...
|
-
From time to time it's healthy to challenge the assumptions, and look at (allegedly) familiar things with new eyes. Few weeks ago I had to do just that with the idea of authentication : I wanted to shake a bit an audience of architects, and make them * think* about the problem instead of relying on the stereotypes they had about it. Judging from the evals I've got, it worked :-) if you want to give it a try, check in at the door what you already know on the subject and come to play! The Tao of Authentication authentic being actually and exactly what is claimed from M-W When I say "authentication", what do you think of? No, I don't mean you identirati people, put your hands down; I mean what's the intuitive idea in the collective imagery. The typical answer you get from a generic audience is something like "it's when you check the identity of the user before giving access". That sounds in line with what traditionally happens as of today, but we'll see that there's more than meet the eye. Why do we authenticate, whatever that means? Simple. During the execution of the service we are offering we need the answer to some specific questions: the authentication phase is one of the ways in which we obtain the answer to those questions. Too abstract? Let me give you some notable examples. Questions Looks different from my usual messy sketches, eh? :) Well, that's a sample of my slides style. Some says they're too busy, some likes them... pick your camp. But I digress. Here we see our usual Read More...
|
-
Last week Caleb and I have been surprised in my office by Charles "Carlo" Torre and his camera. The result is an impromptu interview about CardSpace , which is currently on the front page of Channel9 (direct link here ). If you have time, take a look… we laugh a lot, but we manage to make some serious point here and there :-) and of course we mention the book , which is even on the "front frame". I have to remark that I am *always* amazed by Carlo 's skills as interviewer. He provides a fresh perspective, making the right questions, and yet he discreetly blends giving space to who is interviewed to make his point with his own personal style. And he's not afraid to put you in the spot and ask tough questions... he really takes the part of the audience. Carlo, it's always a pleasure to chat with you :-) Read More...
|
-
Ah, the beauty of models. A good model can capture the essence of a system, a phenomenon, anything: it allows you to easily manipulate things, make predictions, transport the knowledge you already have of a domain to a new one. It's just great, and as we will disclose more things about Oslo I am sure you'll have chance to experience this thing first hand. For the time being, let me dig a bit on a model factory we know very well: the identity metasystem. Back in November, during my EU tour , I had a great discussion with a policy maker: this person has an amazing understanding of the identity metasystem, a deep knowledge of the eID landscape, made all the right questions, he was just a pleasure to converse with. At a certain point he described how they were currently dealing with the problem of transporting in application form a very complex scenario, already tamed from the analytic & regulatory perspective. That prompted me to express a thought about how the identity metasystem could have helped there, and I was surprised by how well received that thought was: he told me he never heard things explained from that point of view, so I thought there could be some value in repeating that here. One of the powers of the identity metasystem, and its architectural backbone WS-*, is that it gives you the tools for describing the relevant aspects of existing relationships: who is affiliated with whom, what are the information an entity needs for making business with somebody, what the Read More...
|
-
It turns out that the channel9 video on ws-trust was down for (quite?) some time. I am pretty surprised by the number of people that is still checking out that clip! Now it works again, provided that you view it by clicking the download button (which, by the way, points to here ) as shown in the screenshot below. The embedded video control is still not working. Thanks to everybody who raised the issue ( Adlai , now I understand your comment about the video... sorry for not getting it earlier) and to Charles who fixed the problem at record speed. Read More...
|
-
On the Paris-Seattle flight, coming back after 2 weeks spent stuffing myself with all sorts of food with the excuse "after all, you can't find this in USA" :) Before hurling myself back in the vortex of daily work, and celebrate the end of the year with something crazy, I want to take some time writing down some hallucinatory (=vision without execution) thoughts about omnidirectional identities . Be warned, this may be just pointless rambling at this point. Few weeks ago I chatted about this in front of a microphone with John Udell , digressing along a crazy tangent instead of answering his questions about the book (I eventually came back to Earth and answered properly :)). I don't know if he'll deem those fragments publication worthy, but just in case I'll make a brain dump here. It's not that there's much more to do in this small seat anyway (just finished the latest Eco . He didn't mention underbite at all, I'm happy). Looking back at the activities related to identity in the past year, I am glad to report that amazing progress has been done. Something that makes 2007 very different from 2006 is the kind of work that was made: in 2007 the accent was on execution. The vision behind the metasystem is still being explored, sure, like Kim's series on linkage or the discussions about display token and first law demonstrate; and I feel that conjugating the metasystem and claims in enterprise environment is an area that still need focus (especially in fighting old forma mentis that Read More...
|
-
In short: I describe why claims are important for every developer and architect (not just the security expert), and I provide some heuristics for helping everybody to reason about claim based systems. I don't think we did an exceptionally good job in explaining claims based programming and its implications. A lot of the literature on the subject is for security experts, hence it explains claims based programming in terms of the delta that differentiates it from more classical methodologies (ACLs, groups, etc). Other material explains the topic for the non-initiated to security, highlighting how digital identity is made of claims and so on; however the point is often lost, because while the reader can see that identity is expressed in a natural way it is not clear *how* the system is superior to classical approaches. In that case a concept easy to grasp, multiple authoritative sources backing it and some generic coolness are all ingredients for a nice information cascade . It reminds of another eminent (IMHO) information cascade : the schema-first approach to service oriented programming. Schema first is great in a number of occasions, but uselessly onerous in many tactical scenario: you don't really need to concoct an XSD for every message you send internally or to system that will never ever have to interoperate, validate complex messages or manipulate standard entities. And yet, *a lot* of people got is as a dogma (ie, without really understanding why it's useful) and started Read More...
|
-
In short: I briefly discuss some differences between the password based authentication model and the token based one; then I propose that we lack a proper term for describing some of the transactions enabled by cardspace and the token based model. Sometime we get so used to the metaphors used in computer science, that they cease to be metaphors. When I use my Windows' desktop I certainly don't think of my physical desk (though they are messy in a very similar fashion), nor I think of real folders when I design the directory structure of a Visual Studio project. During almost 2 years spent explaining CardSpace to a wide variety of people, I have noticed some consequences of this phenomenon in the identity management space. The Identity Metasystem offers a very natural way of thinking about identity, one that allows us to leverage the knowledge and skills that serve us well in identity-related transactions in the offline world (the beaten up driving license for buying alcohol example comes to mind). CardSpace supports that fully, by supplying a solid & intuitive way of handling tokens and exercising full control on what information is disclosed to whom. However, is that message intuitively compatible with the idea that the typical web site tenant have of authentication? In my experience, not always; luckily, however, bridging the gap is very easy and takes few simple considerations. In basic scenarios, authentication is often viewed as one mechanism for making sure that who Read More...
|
-
This morning I was reading Newsweek (before you get any ideas: I subscribed to BOTH Newsweek and Time) and the interesting account they made about the history of a person. Much is being written on the subject, just browse your favourite news website for the details: however the summary is that this person was traveling through Europe while having a drug-resistant form of tuberculosis, raising worries about the spread of the disease. Health officials tried to locate him and minimize his chances of infecting others (apparently the infection is much more likely to occur when you spend a long time with the subject, like in an airplane cabin). When they finally managed to talk to him he was in Rome: since there was no way for him to travel in "normal" ways back to US without endangering also the pilot, the guy was advised to hire a private jet or go to an Italian hospital. NOW there's the part of the story that is relevant to identity. This person didn't go to stay in an Italian hospital, nor he hired a private jet: he boarded a commercial flight and simply flew home. How did he do that? According to Newsweek, his name was promptly included in the no-fly list; however the man flew from the EU to Montreal, and apparently Canada was not alerted about the situation. Once entered in Canada he rented a car and drove into the US, managing to go through the border after few routine questions. The article I read is available in electronic form here . This story uncovers one drawback of relying Read More...
|
-
In short: Gianpaolo presents a daring proposition about a deregulated IT . I believe that GP's idea is a very valid one. In the post below I explore the implications of a world where consumerism is brought to the extremes of IT deregulation: in such a world user centric identity management and user control/consent are key enabling aspects that cannot be ignored . From time to time I have nice chats with Gianpaolo, during which he gives me glimpses of his thinking about where IT is going. I especially liked his considerations about consumerism and deregulated IT: not that he finally made a post on the topic , I can share some of the trends and implications I draw from it. The foundation of this entire matter lies in becoming fully aware of the trend that has been dubbed as consumerism. This is already a pretty loaded term already, however I really like the position of Peter Sondergaard (Gartner director of global research), as captured by David Berlind at the Gartner Symposium/ITxpo: Sondergaard went on to describe how consumer technologies and configurations now rival and often exceed in the prowess of the corresponding technologies found in the organizations that are used to serving consumers on their terms ("their" being the organizational side). "Consumers are rapidly creating personal IT architectures capable of running corporate style IT architectures" said Sondergaard. "They have faster processors, more storage, and more bandwidth. In 2012, expect consumer technologies to Read More...
|
-
I LOVE Wired . It's the only magazine I read on regular basis (every issue, actually) for which I DON'T have a subscription. That would deprive me from the pleasure of buying it as soon as I spot it on the shelf, thing that happen with other magazines (I am subscribed to Business2.0 : when I see it on the shelf I can't buy it no matter how appealing the cover story is, because I know I'll get a copy in the mail). I did this only for another publication in the past, "I cavalieri dello zodiaco" (u may know them as Saint Seya or 聖闘士星矢 ), so it's truly a big deal for me:-). I also love neologism, when they capture an important concept that didn't have a name yet. "Crowdhacking" is one of those. Back to the case on point. In the last issue there is a great article that explores the value of online reputation ... and ways of subverting current mechanisms of attributing it/using it. I won't make here the long dissertation you may expect on how Windows CardSpace and user-centric identification schemes can be of immense help there... first, because I'd like you to read the article first (so I don;t have to recreate its context here before saying my thing); second, because when you are writing a book every moment you spend writing something else makes you feel guilty for falling behind schedule :-) The latter is also the reason for which I'm not being very prolific lately, but I promise I'll try to do something about it in the coming weeks. There's really a lot to say on the subject! How Read More...
|
-
One of the most common question I've got in the last year or so had to do with OpenID and if it had a role in out future plans. I can only guess that the OpenID guys received a corresponding question about CardSpace... well, you don't need to wonder anymore. *** Hardt of Sxip Identity , Michael Graves of VeriSign , Scott Kveton of JanRain and our very own Kim Cameron published an announcement in which they disclose that " JanRain, Microsoft, Sxip, and VeriSign will collaborate on interoperability between OpenID and Windows CardSpace™ to make the Internet safer and easier to use ". Now: this not only *great* for identity itself, but I believe it is a lesson about the whole WS-* versus REST debacle. The two approaches deal with different problems, and the choice between the two does not need to be exclusive. Trends and hype cycles tend to polarize everything, often parties become religious about their choices ( certain fanatics even go as far as putting their favourite approach on their license plate :-)). Hopefully today's announcement will show that integration is not only possible, it is the way ahead. Always IMHO, naturally :-) Read More...
|
-
The product is not out yet, and I already think of the stuff I'd like in vNext.. :) Today's wishful thinking is about chains of trust. Imagine that your department of driving licences (DDL) issues you a managed card which represents the digital counterpart of your phisical license card. Your bank will presumably trust it: after all, if you go in a bank branch for cashing a check showing your driver license is enough for visual identification. A managed card would be even better, thanks to the cryptographic guarantees. That's fantastic! The bank may leverage this trust relationship, and allow me to access my home banking by using my driving license information card (DLIC): if the DDL already authenticated me, and the bank trusts the DDL, why should the bank repeat the operation. However there's a small problem. The claims in the DLIC may be useful for discovering that my name is Vittorio Luigi Bertocci, that I'm a guy, that I was born in <haha, do you think I'll really blog it?> and that I can drive cars (but not trucks): however, they don't help much if many of the bank backend services want to know my credit history. The credit history is a claim that is part of my identity as a subject that deals with money, as opposed to a subject that drives around: no surprise that a token obtained from the DDL does not contain it. Of course we won't be stopped by such trivial problems: the bank can install an happy resource STS (R-STS), which will transform the incoming DLIC-derived Read More...
|
|
|
|