Notice: This Wiki is now read only and edits are no longer possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.
Difference between revisions of "Authentication Service 2.0"
(→Requirements) |
|||
Line 4: | Line 4: | ||
This page describes a new network [[Authentication Service 1.1]]. The idea would be move Higgins services to a federated model. This would mean that both the Higgins Selector app (e.g. [[GTK Selector 1.1-Win]]) and all supporting services (e.g. [[I-Card Service 1.1]], [[CardSync Service 1.1]], etc.) would rely on this new, external [[Authentication Service 1.1]]. | This page describes a new network [[Authentication Service 1.1]]. The idea would be move Higgins services to a federated model. This would mean that both the Higgins Selector app (e.g. [[GTK Selector 1.1-Win]]) and all supporting services (e.g. [[I-Card Service 1.1]], [[CardSync Service 1.1]], etc.) would rely on this new, external [[Authentication Service 1.1]]. | ||
− | + | == Requirements == | |
#Use OpenID/OAuth where possible | #Use OpenID/OAuth where possible | ||
#Allow [[Authentication Service 1.1]] to also control the metadata (e.g. location) of $contexts via XRD discovery | #Allow [[Authentication Service 1.1]] to also control the metadata (e.g. location) of $contexts via XRD discovery | ||
Line 16: | Line 16: | ||
#Security must be at least as good as overall selector system today | #Security must be at least as good as overall selector system today | ||
+ | ==Implementation== | ||
=== Service === | === Service === | ||
* First version should be an OpenID OP and use OAuth for returning the access token | * First version should be an OpenID OP and use OAuth for returning the access token | ||
* Would authenticate using a combination of (i) a manually typed in un/pw + (ii) POP of a client-serialized-key + (perhaps) (iii) some digital fingerprint data from the machine | * Would authenticate using a combination of (i) a manually typed in un/pw + (ii) POP of a client-serialized-key + (perhaps) (iii) some digital fingerprint data from the machine | ||
* Returns access token in browser redirect | * Returns access token in browser redirect | ||
+ | |||
=== Selector changes: LICS Authentication === | === Selector changes: LICS Authentication === |
Revision as of 16:52, 5 September 2009
{{#eclipseproject:technology.higgins|eclipse_custom_style.css}}
This page describes a new network Authentication Service 1.1. The idea would be move Higgins services to a federated model. This would mean that both the Higgins Selector app (e.g. GTK Selector 1.1-Win) and all supporting services (e.g. I-Card Service 1.1, CardSync Service 1.1, etc.) would rely on this new, external Authentication Service 1.1.
Contents
Requirements
- Use OpenID/OAuth where possible
- Allow Authentication Service 1.1 to also control the metadata (e.g. location) of $contexts via XRD discovery
- Allow unmodified OpenID OP to be used (optionally) to auth to selector app
- Allow XRI OP to be used to auth to selector app
- Preserve today's "local" un/pw auth to be used as another option
- All identifiers must use http[s] scheme
- Authentication Service 1.1 requires another factor when directly accessing selector data (e.g. cloud selector functionality)
- Client side must use native code for auth UI
- Client code must use secure storage for "saved" passwords
- Security must be at least as good as overall selector system today
Implementation
Service
- First version should be an OpenID OP and use OAuth for returning the access token
- Would authenticate using a combination of (i) a manually typed in un/pw + (ii) POP of a client-serialized-key + (perhaps) (iii) some digital fingerprint data from the machine
- Returns access token in browser redirect
Selector changes: LICS Authentication
Changes required to the un/pw login dialog box:
- Allow the user to login not just with a "local" un/pw approach, but also via one of a number of trusted OpenID providers. This would mean that the user could choose between "local" login (today's approach) or by clicking on 1..N buttons that represent OpenID or SAML IdPs.
- The login module would initiate an OpenID/OAuth interaction with the IdP. It would only initiate OpenID/OAuth to hard-coded list of IdPs.
- The login module would (through browser redirect back) end up with an access token
- The Local I-Card Service Package would send this access token (in addition to proof of possession of a serialization key) on every message to the I-Card Service 1.1, CardSync Service 1.1, IdAS Proxy Service 1.1 and the Attribute Service 1.1 "meta" Context.
While we're making changes to the login module:
- There could be a checkbox: "Clear all data from this machine when quitting this application". If checked, the LICS would delete all locally stored data from the machine when the Azigo app quit.
Changes to Selector-Supporting Services
The I-Card Service 1.1, CardSync Service 1.1, IdAS Proxy Service 1.1 and the Attribute Service 1.1 would all need to be changed to rely on the access token generated by the Authentication Service 1.1 for authentication.