Identity Federation: Some Challenges and Thoughts OGF 19 Jan 30, 2007

1. Identity Federation:Some Challenges and ThoughtsOGF 19Jan 30, 2007 Von Welchvwelch@ncsa.uiuc.edu

2. Topics • Identity Federation and Federated Identities • Motivations • Privacy • Incident Response GSI Credential Management OGF 19 Federated Identity Session

3. Identity Federation and Federated Identities • We are talking both about two types of federation • Federating identity systems • Allowing users at A, B, C, etc. to access Sites X, Y, Z, etc. • Federating individual identities across systems • Allowing a user to have an identity composed of attributes from L, M, N, VO, etc. GSI Credential Management OGF 19 Federated Identity Session

4. Motivation for Identity Federation • Identity Federation is a lot of work • Ask anyone here… • Why are we doing it? • Yes, it’s cool. • Copper plumbing is cool too, but not many have it. • At the end of the day, how will it pay the bills? GSI Credential Management OGF 19 Federated Identity Session

5. Motivations • User: Holy grail of security - convenience • Resource provider: Outsourcing of user management (If we can work out incident response) • Virtual Organization: Another win, enable them to participate in identity • Identity Provider: Get to be really nice guys? GSI Credential Management OGF 19 Federated Identity Session

6. Privacy • Kim Cameron’s laws of Identity • Sounds good • Some resource providers want to keep users pseudo-anonymous • And we can help there • What about in other cases? • Plenty of other privacy leaks for SPs looking to circumvent it • Identity today on the Internet is really IP addresses GSI Credential Management OGF 19 Federated Identity Session

7. Privacy? • This is really least privilege • And we haven’t had much success getting users interested there • Will users care enough to read a pop up? • Really, I think anonymization services are needed • E.g. Web Anonymizers • Trust Negotiation may have a role to play here GSI Credential Management OGF 19 Federated Identity Session

8. Who is going to represent the user? ``Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptable speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed. But they are sufficiently pervasive that we must design our protocols around their limitations.)'’ • Network Security / PRIVATE Communication in a PUBLIC World by Charlie Kaufman, Radia Perlman, & Mike Speciner (Prentice Hall 2002) GSI Credential Management OGF 19 Federated Identity Session

9. User Representation? • Think we can agree users need help • Policies, attribute wallet, all that state • Who will provide it? • Current Identity Providers? • My University, ProtectNetwork, etc. • My Bank? • Seems like they are going to have to be an IdP anyway, maybe they can make money at it? • Local OS? • CardSpace/KeyChain/Higgins/etc. • Is there a difference between this and a network service any more? • What is the agreement going to be between the user and this party? GSI Credential Management OGF 19 Federated Identity Session

10. Incident Response • Everything is great until something goes wrong - Murphy’s 2nd Law • When we start moving to valuable resources, it seems clear that incident response is going to be a big issue in all of this GSI Credential Management OGF 19 Federated Identity Session

11. Incident Response • Theorem: Resource providers must have the ability to act locally, think globally • It must be possible for a resource provider to cut off any user locally, without having to involve anyone else • Then it must be must be possible for the process to proceed on the global stage GSI Credential Management OGF 19 Federated Identity Session

12. Incident Response • What is the global process? • What are the separation of duties/SLA intersections? • It seems resource provider is typically the wronged party and bears liability • User may sometime bear some liability • E.g. my allocation got eaten! • Different from physical world case of credit cards where user is the wronged party and credit provider bears ultimate liability GSI Credential Management OGF 19 Federated Identity Session

13. Incident Response • Liability implies Resource Provider must drive Incident Response • Comparison to current practice with ISP: wronged party must get court order to map Internet identity (IP address) to real world identity • Our resource providers have SLA with IdPs, which helps • But if this is going to work, IdPs must care about incidents GSI Credential Management OGF 19 Federated Identity Session

14. Incident Response • Theorem: If this is going to work, IdPs must eat their own dog food - I.e. they must be as dependent on the Identity System as the resource providers • Use of Identity System internally tells you more about its reliability that any policy statement • Similar use to resource provider and you’re probably in good shape • No policy will allow IdP to effectively run a system with external use unfamiliar to IdP GSI Credential Management OGF 19 Federated Identity Session

15. Thank you GSI Credential Management OGF 19 Federated Identity Session