Authentication Materials

{{#eclipseproject:technology.higgins|eclipse_custom_style.css}}

About

This page describes the concept of Authentication Materials used in the Context Data Model 1.1. Authentication Materials are needed to open a Context.

Current Situation

Currently, IdAS authentication materials in the IContext.open() call are defined to be just a java.lang.Object. This gives maximal flexibility to Context Provider implementations.

Goals

We would like to be able to do the following:

1. Have identifiers for common types of Authentication Materials
   • This is needed in scenarios when you do not know a priori what type(s) of Authentication Materials a Context accepts.
   • For example, for R-Cards we use UDIs to point to Higgins Contexts and Entities. When a UDI is resolved, we need to know what type of Authentication Materials is needed for opening the Context it points to.
2. (De-)serialize a concrete instance of Authentication Materials (e.g. to/from XML, String, etc.)
   • This is useful in scenarios in which you send Authentication Materials over the network, e.g. in IdAS REST interfaces such as http://code.bandit-project.org/trac/wiki/OTIS and the XDI Engine.

Proposal for Goal #1

• Define the following identifiers for common types of Authentication Materials:
  1. urn:higgins:authmethod:1.0:usernamePassword
  2. urn:higgins:authmethod:1.0:anonymous
  3. urn:higgins:authmethod:1.0:p-infocard
  4. urn:higgins:authmethod:1.0:m-infocard
  5. urn:higgins:authmethod:1.0:samlpolicy
  6. urn:higgins:authmethod:1.0:implied
  7. ... TODO ...
• Make it possible to pass additional information in the identifier, e.g. a RP's security policy (the semantics of what's in an I-Card <object> tag). This could be done by using the query string of the identifier, e.g.

urn:higgins:authmethod:1.0:m-infocard?policyhere

• The special identifier urn:higgins:authmethod:1.0:implied means that the party trying to open the Context must somehow know by itself what Authentication Materials to use. E.g. in SSO scenarios, that party may already have a session established with the user, or in some other way know their credentials

Proposal for Goal #2

• Introduce an interface "IAuthnMaterials" in org.eclipse.higgins.idas.api.
  • Make this only a marker interface without methods
  • As a convention, implementations of this interface should provide a toString() method that can serialize the Authentication Materials to a String, and a constructor with the arguments (IContext, String), which can be used to reconstruct the Authentication Materials from the String.