Home

OpenID

User-Centric Technologies

Submitted by Andreas Åkre Solberg [1] on 12 November, 2009 - 12:11

User-Centric Identity within Identity Federations.

  • $Id: gn3-usercentric-technologies.txt 179 2009-11-12 11:11:41Z andreas $
  • Author: Licia Florio florio@terena.org

Introduction

Managing authentication and authorisation mechanisms is quite a complex task. In the academic community this task becomes particularly challenging as researchers, lecturers and students often move between institutions and departments and collaborative projects require users to share their resources. These changes not only affect the individuals concerned, but also their roles within the institutions, which have to be taken into account. It is therefore important to be able to keep track of, and handle the changes that continuously take place.

The mapping of users to electronic identities is a strategic element in any organisation, since it constitutes the basis for the access to institutional data and IT services. This process is known as Identity Management.

In recent years...

Identity Discovery Usability

Submitted by Andreas Åkre Solberg [1] on 22 October, 2009 - 15:09

JISC and Bob 'RL' Morgan initiated a discussion on IdP discovery usability that inspired me to try to summarize my thoughts on the topic.

What is bad today? - Examples from real life

UK Access Federation

In a UK federated service, you would need to know that you must click Shibboleth login (notice: a name of some piece of software), in order to get to a discovery service. A SP-specific IdP Discovery Service today in UK Access Federation will present you with a drop-down box of approximately 750 entries listing universities. It takes quite some time for a browser to scroll to the bottom. When the user goes to the next SP, he/she is blessed with the wonderful SSO experience with simple login, but before that happens, the user is presented with the same question and 750-entries-long drop-down list.

Question or answer?

When a danish user goes to a Kalmar Union service, and is presented with a IdP Discovery Service service asking something along Where are you from?.

Feide OpenIdP gets OpenID support

Submitted by Andreas Åkre Solberg [1] on 21 October, 2009 - 08:46

If you have created an account on the Feide OpenIdP, you may now use that account to login to any OpenID site. You may also setup your blog to point to OpenID for authentication - then you will get your blog URL as an openID, and you will be asked for username password on Feide OpenIdP.

Re-written modularized OpenID Provider Code Available in SimpleSAMLphp

Submitted by Andreas Åkre Solberg [1] on 16 October, 2009 - 14:02

SimpleSAMLphp a long time ago contained both an OpenID Consumer and an OpenID Provider, the days when simpleSAMLphp was not modularized.

Then, there was a major upgrade of the OpenID Consumer part, where the code was modularized and updated. The Provider part then disappeared...

Now, Olav brough back the OpenID Provider, in a fresh re-written modularized form.

The code is available in subversion, and will be part of the 1.5 release later this month. Please start testing it and report any problems.

May be it is time for us to re-launch our experimental Feide OpenID Service?

OpenID Provider Documentation

Submitted by Andreas Åkre Solberg [1] on 16 October, 2009 - 13:09

Documentation on the openidProvider module in simpleSAMLphp.

simpleSAMLphp can act as an OpenID provider. This allows you to integrate OpenID into an existing IdP, or to add a bridge between OpenID and SAML 2.0.

To use it, you need to enable the OpenID provider module:

touch modules/openidProvider/enable

You must also edit the configuration file:

cp modules/openidProvider/config-template/module_openidProvider.php config/
"$EDITOR" config/module_openidProvider.php

Options

The following options must be set in the configuration file:

auth
The authentication source that should be used to authenticate users who access the OpenID endpoint. This can be any authentication source configured in config/authsources.php.

To configure this as a bridge, set up a saml authentication source, and use that one.

username_attribute
The name of the attribute that contains the username of the user.
filestore
A path to a directory where the OpenID provider can...

OpenID Federations

Submitted by Andreas Åkre Solberg [1] on 28 September, 2009 - 08:02

If I had to design an Identity Federation entirely based upon OpenID, how would I approach that?

  • $Id: openidfederation.txt 140 2009-09-28 09:23:38Z andreas $

Introduction

If I had to design an Identity Federation entirely based upon [OpenID][], how would I approach that?

I would need the following components:

  • OpenID Extension: UserID Expansion
  • Scoping
  • Whitelist URLs

OpenID Extension: UserID Expansion

I don't think that the current user experience with entering your own URL is a very good one, so I would propose this:

The OpenID Consumer would as usual ask the user to enter his/her OpenID.

If the Consumer recognise the OpenID to contain an '@', and the format satisfy LocalUserID@realm.tld, the Consumer would expand the UserID to be:

https://openid.realm.tld/LocalUserID

Then the Consumer continues with normal OpenID operations using this OpenID.

Detailed expansion rules

$LocalUserID$ is the part before the '@', and $realm$ is the...

Experimental OpenID Consumer Support Added

Submitted by Andreas Åkre Solberg [1] on 24 September, 2008 - 15:27

SimpleSAMLphp now have experimental support for OpenID Consumer. Check out latest version from trunk and enable the openid module to test it.

OpenID Consumer Soon Ready

Submitted by Andreas Åkre Solberg [1] on 21 September, 2008 - 20:45

OpenID Consumer support is beeing worked on, and will soon be ready for testing. The janrain OpenID library included with simpleSAMLphp is now upgraded to the latest 2.x version.

OpenID Provider fixed in simpleSAMLphp

Submitted by Andreas Åkre Solberg [1] on 19 September, 2008 - 15:19

Unfortunately the OpenID Provider part of simpleSAMLphp has not been maintaned, and did not work.

I've fixed. But still, this part is in beta status. I've plans to add support for OpenID Consumer very soon. As well as upgrade to latest JanRain library to support OpenID version 2.0.

My new name is =andreas

Submitted by Andreas Åkre Solberg [1] on 29 May, 2008 - 21:23

I figured out I had to take a bit more part of the OpenID community to see what's up. First thing I realized was that I was missing something fundamental: a i-name.

So I went out shopping (yes, i-names cost money). Beeing a mac-user I went for the i-broker (I think it is called that) with the roundest edges and most vivid colours: equalsyou.com.

Now =andreas is my new name, and I'll try figure out what I can do with it. I understand I have to understand how URI becomes IRI becomes XRI and are described with XRDS documents exchanged with XDI somehow, and that it solves all possible problems with identities and identifiers. Now, I need to get some sleep.