Identity Federation: Some Challenges and Thoughts OGF 19 Jan 30, 2007 Von Welch

1/30/072GSI Credential Management OGF 19 Federated Identity Session Topics Identity Federation and Federated Identities Motivations Privacy Incident Response

1/30/073GSI Credential Management OGF 19 Federated Identity Session Identity Federation and Federated Identities We are talking both about two types of federation Federating identity systems –Allowing users at A, B, C, etc. to access Sites X, Y, Z, etc. Federating individual identities across systems –Allowing a user to have an identity composed of attributes from L, M, N, VO, etc.

1/30/074GSI Credential Management OGF 19 Federated Identity Session Motivation for Identity Federation Identity Federation is a lot of work –Ask anyone here… Why are we doing it? Yes, it’s cool. Copper plumbing is cool too, but not many have it. At the end of the day, how will it pay the bills?

1/30/075GSI Credential Management OGF 19 Federated Identity Session Motivations User: Holy grail of security - convenience Resource provider: Outsourcing of user management (If we can work out incident response) Virtual Organization: Another win, enable them to participate in identity Identity Provider: Get to be really nice guys?

1/30/076GSI Credential Management OGF 19 Federated Identity Session Privacy Kim Cameron’s laws of Identity –Sounds good Some resource providers want to keep users pseudo-anonymous –And we can help there What about in other cases? Plenty of other privacy leaks for SPs looking to circumvent it Identity today on the Internet is really IP addresses

1/30/077GSI Credential Management OGF 19 Federated Identity Session Privacy? This is really least privilege –And we haven’t had much success getting users interested there Will users care enough to read a pop up? Really, I think anonymization services are needed –E.g. Web Anonymizers Trust Negotiation may have a role to play here

1/30/078GSI Credential Management OGF 19 Federated Identity Session Who is going to represent the user? ``Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptable speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed. But they are sufficiently pervasive that we must design our protocols around their limitations.)'’ –Network Security / PRIVATE Communication in a PUBLIC World by Charlie Kaufman, Radia Perlman, & Mike Speciner (Prentice Hall 2002)

1/30/079GSI Credential Management OGF 19 Federated Identity Session User Representation? Think we can agree users need help –Policies, attribute wallet, all that state Who will provide it? Current Identity Providers? –My University, ProtectNetwork, etc. My Bank? –Seems like they are going to have to be an IdP anyway, maybe they can make money at it? Local OS? –CardSpace/KeyChain/Higgins/etc. –Is there a difference between this and a network service any more? What is the agreement going to be between the user and this party?

1/30/0710GSI Credential Management OGF 19 Federated Identity Session Incident Response Everything is great until something goes wrong - Murphy’s 2nd Law When we start moving to valuable resources, it seems clear that incident response is going to be a big issue in all of this

1/30/0711GSI Credential Management OGF 19 Federated Identity Session Incident Response Theorem: Resource providers must have the ability to act locally, think globally It must be possible for a resource provider to cut off any user locally, without having to involve anyone else Then it must be must be possible for the process to proceed on the global stage

1/30/0712GSI Credential Management OGF 19 Federated Identity Session Incident Response What is the global process? –What are the separation of duties/SLA intersections? It seems resource provider is typically the wronged party and bears liability User may sometime bear some liability –E.g. my allocation got eaten! Different from physical world case of credit cards where user is the wronged party and credit provider bears ultimate liability

1/30/0713GSI Credential Management OGF 19 Federated Identity Session Incident Response Liability implies Resource Provider must drive Incident Response Comparison to current practice with ISP: wronged party must get court order to map Internet identity (IP address) to real world identity Our resource providers have SLA with IdPs, which helps But if this is going to work, IdPs must care about incidents

1/30/0714GSI Credential Management OGF 19 Federated Identity Session Incident Response Theorem: If this is going to work, IdPs must eat their own dog food - I.e. they must be as dependent on the Identity System as the resource providers Use of Identity System internally tells you more about its reliability that any policy statement Similar use to resource provider and you’re probably in good shape No policy will allow IdP to effectively run a system with external use unfamiliar to IdP

1/30/0715GSI Credential Management OGF 19 Federated Identity Session Thank you