Category: Identity

Dick Hardt and Identity 2.0

Dick Hardt has moved the identity part of his blog to Identity 2.0. Identity 2.0 is his meme for differentiating user-centric identity from what came before it. I like it.

Dick gave an absolutely fantastic presentation on identity at DIDW last week. It was intensely visual and direct – and really got his point across. Everyone who saw it came out a changed person. So I wonder if it's possible for him to put together a flash animation that we could all point our friends to…

Brainstorm on the Identity Big Bang

Speaking of Johannes, at the bottoms up identity meeting preceeding DIDW he made some really good points about the need to brainstorm deeply on what we mean by an identity big bang. How will applications change? What new applications will appear? I think Johannes is right on target when he calls on us to turn the discussion in this direction. So let's all start ruminating… and then get to work on this.

Fast Forward to InfoCards

Here's a good summary of what those of us working on InfoCards are trying to do, written by Johannes Ernst of Netmesh and LID. At DIDW Microsoft released a whitepaper referencing InfoCards called Microsoft's Vision of an Identity Metasystem. But Johannes has zoomed in on a number of very interesting pieces in the puzzle – including how what we learned through metadirectory relates to the ideas in the identity metasystem, the web services protocols underlying it, and how an identity selector would work.

Personally, I'm really looking forward to the day I can put up a demo – this is a case of a system which is a whole lot easier to use than to describe. But Johannes has done a really good job of bridging that gap.

If you Google Microsoft's InfoCard, you mostly seem to find people asking “who can tell me more about InfoCard”, but very little actual answers. Here is what I've learned from public statements by Kim Cameron and other Microsoft people, and the public demo they did at Digital Identity World 2005. (Disclaimer: I may be wrong about some things, as I don't work for Microsoft. Also, I believe all of the information here is public. If I'm wrong on either count, please do let me know.)

To understand InfoCard, you need to understand Kim Cameron, InfoCard's architect. Kim is credited with being the, or at least one of the inventors of the concept of a meta-directory. A directory (as in corporate directory, LDAP, that kind of thing) is a special kind of database run by companies to manage information about their employees, such as their names, phone numbers, e-mail addresses, office locations, as well as computers, printers and sometimes access permissions to various applications or information. When companies started to deploy directories, very quickly multiple directories were found within the same company, and the question arose how those directories could be used together, because some directories would know information about some employees but not others, etc. The idea of a meta-directory is to have a piece of software that would appear just like any other directory, but that would pull its data from other directories. In other words: have your cake and eat it, too. Keep whatever directories you have, but make all their information appear in one place (coincidentally one of the core principles behind our NetMesh InfoGrid as well).

So when Kim decided to do something about digital identity, he used the same mindset that he used for the idea of a meta-directory, because he saw the same market conditions in this area: lots of incompatible digital identity systems, that prevent everybody from interacting with most other people — just like stovepipe directory systems would prevent one person from accessing a printer defined in another. In the identity space, not only do we have Microsoft Passport, Liberty Alliance, SXIP, Identity Commons, and our LID, but thousands, or maybe far more, home-grown account and user registration systems. In Kim's view, while there may be advantages that one of those systems has versus others, the real problem is fragmentation of digital identity systems, just like fragmentation of directory systems back then. So the core idea for InfoCard is to be a meta-identity system, with the word “meta” meaning the same thing as it does in the term meta-directory system.

Another way saying the same thing would be by parallel with TCP/IP as the universal abstraction layer that abstracts away from things like Ethernet, but nevertheless depends on them. Using this analogy, we could think of InfoCard just like we do about TCP/IP (in relation to digital identity systems and Ethernet or WiFi, respectively).

Kim's hope that by having such an abstraction layer, such a big momma identity backplane (as Marc Canter puts it so memorably), we can get an explosion of identity-enabled new applications. And he adds another analogy: there was little innovation in graphics before there were commons APIs that developers could use to talk to any graphics card, but then it exploded, we got graphical user interfaces and all of that. Without that common API, the next level of innovation simply wasn't possible. He thinks that it will be the same about identity.

Before we get into the guts, let's list some more of the assumptions behind Infocard: (you should also read Kim's Laws of Identity which I won't cover here but which contain a lot more interesting assumptions)

  • Kim believes that it has to be an entirely open system. My understanding is that Microsoft will find a license (I also understand they have not settled on one, in fact Kim is looking for input), that allows anybody to create any part or all of InfoCard themselves. Unlike some earlier rumors, InfoCard does not seem to be released as open source itself, but admittedly, that would really have surprised me.
  • InfoCard is built entirely on the web services (WS-*) stack. Given that it is a very distributed system, this choice is understandable. Kim says that while not all WS technologies used in InfoCard have been blessed yet by suitable standards bodies, all of them are on the standards track already.
  • Because of the need to combat phishing and other attacks where outside stuff (web pages, viruses popping up application windows etc.) pretends to be something else to the user, InfoCard will be anchored pretty deeply inside the Windows OS in a secure process space.
  • The InfoCard — like a virtual credit card or membership card — metaphor is the central user interface metaphor.
  • InfoCard only defines the “framework” protocols between the InfoCard client-piece (the one inside Windows), an identity provider, and a relying party (e.g. a website that requires identifying information). Lots of parties can be an identity provider or a relying party using many (all?) of today's identity systems which can plug into the InfoCard system by adding actual content into the defined messages.

Here is an example use case:

  1. An InfoCard-enabled user (e.g. one running the upcoming Windows Longhorn, or the downward-compatible release for XP) first signs up with one or more identity providers of their choice. That could be their ISP, their bank, a site like eBay, or Slashdot. This process is entirely outside of InfoCard, but of course the identity provider must support their part of the InfoCard protocol.
  2. The user visits an InfoCard-enabled relying website (such as an InfoCard-enabled Amazon) that requires certain identity information from the user, say, a shipping address. The website sends a web page which contains an HTML OBJECT tag, which triggers a DLL which invokes the InfoCard system.
  3. The InfoCard system determines which personal information is requested by the website, and matches it to the identities (i.e. InfoCards) that are in possession of the user. It then displays those InfoCards to the user that are applicable, such as: driver's license (if the government was an InfoCard-enabled identity provider), or credit card from AMEX. Note that the InfoCard selector runs natively on the PC and is not downloaded.
  4. The user selects an InfoCard to use. The dialog shown takes over the entire Windows screen (similar to the Windows login / logout dialogs today) in order to reduce phishing. It would also be difficult for an attacked to bring up a screen that has the exact set of InfoCard pictures on it as the user owns, as the information about which cards the user has is stored securely in a secure area of Windows. As a result of the selection, the InfoCard process on the PC contacts the selected identity provider, and obtains essentially a signed XML document that contains the requested identity information. The signature comes from the identity provider.
  5. The InfoCard PC piece then forwards the obtained document to the relying party (the website).
  6. However, InfoCard does not describe the actual tokens flying around, thereby enabling other identity systems to plug in.

In order to accomplish this, InfoCard employs:

  • SOAP
  • WS-Addressing
  • WS-MetadataExchange
  • WS-Policy
  • WS-Security
  • WS-SecurityPolicy
  • WS-Transfer
  • WS-Trust
  • XML Signature
  • XML Encryption

Does this make sense do you? It does to me … Feel free to post back or contact me if I'm wrong or incomplete or you have questions or …

Unblocking RSS Feed

Seems my RSS feed has been blocked since May 8th.

I'm trying to unblock it – working with Radio Userland. Maybe I need some quality management software here.

Jamie on the Asphalt metaphor

I just saw that Jamie Lewis has posted this set of links to articles on DIDW by Between the Lines – Phil Becker's keynote, the discussion of federation standards, John Shewchuk's keynote and Jamie's Wednesday keybnote.

I look forward to Jamie's presentations for their panoramic scope – a rare pleasure – and invariably find myself on the edge of my seat waiting for the pithy new metaphor he has discovered.

And this year, it was the idea that the current debates over protocols deserve about the same degree of interest as do arguments over the chemical composition of asphalt amongst those building a network of highways for the nation. Even here, it isn't the roads themselves that are the final product. It's the “neat cars and trucks” that run on them.

Today's post adds clarification to some of the coverage:

I … want to clarify one thing that Chris Jablonski said in his post summarizing my keynote. Chris summarized something I said this way:

However, he cautioned that achieving meaningful implementation by the end of the decade will depend on how long the vendors want to fight over building the road (standard framework) as opposed to building neat cars and trucks (more proprietary solutions).

Actually, the “neat cars and trucks” aren’t proprietary systems in the analogy I was using. My point was this: Arguments over the chemical composition of asphalt (the protocols necessary to build the standard framework) is of little value to customers who need a solution to a very real problem. What customers want is products and services that solve their identity problems (the cars and trucks that actually help people get somewhere) but that work in an interoperable system (cars that run on the public road). So in the analogy, I was trying to encourage the vendors to quit arguing over how to build the road, settle on what asphalt formula we’ll use, and focus instead on building the interoperable solutions that solve a real problem, which customers will want to buy.

And in that light, the interoperability profile for Web-based SSO between Liberty and the WS-* frameworks that Sun and Microsoft announced today are certainly encouraging. More on that later.

Doc's links

Want some links? Doc Searls has been assembling some over at Doc Searls’ IT Garage (the blog where he discusses identity issues):

Here's a pile of links on the Identity Conversation, coming out of last week's DIDW conference in San Francisco…

On the one hand, it's clear that most of the folks following this thing are giving Kim and Microsoft a lot of slack (no “Passport 2.0” this time around, thankfully). On the other hand, we still have a long way to go.

He's right. We do.

Doc did an amazing couple of sessions on the final day at DIDW – I wonder if Phil Becker will eventually make them generally available as podcasts? That would sure be cool – though it's a lot to expect out of a conference – even a forward thinking one like DIDW.

A convenient shorthand

By the way, in case you don't know me personally, I want to make sure one thing is pretty clear. When I look at the “Kim Cameron World” aspect of what happened at last week's DIDW (as described, humorously, by Dave Kearn below) I hope everyone sees my name as being symbolic – a convenient shorthand for referring to the work a great number of us have done together to get the identity metasystem and laws off the ground.

This doesn't mean I don't appreciate the personal gestures and remarks – I am completely overwhelmed by the generosity of my colleagues across the industry.

Passing the Kearns Test

Few are better at rooting out half-baked ideas than Dave Kearn of Network Fusion and Network World. When he shoots a barb your way, pay attention. First of all, it will be too witty to ignore. More important, it's sure to contain at least one important idea.

So it's been great having Dave along in the part of the identity odyssey we've completed so far. I've counted on him to point out the parts of the discussion which are flabby, ill-expressed or don't hold together – and for offering remedies from his long experience in the trenches. In this regard, Dave is very well known as a neutral and trustworthy commentator by all those who deploy and manage identity systems.

I'm very moved by his kind personal comments in the piece below. But above all, I'm proud that through this conversation we have been able to earn his support for the laws as a place from which to begin structuring an ongoing identity conversation that doesn't always revert to page zero. Here's what he says in his latest newsletter.

I spent an enormously enlightening week at Digital ID World in
San Francisco last week. Actually, it probably could have been
renamed “Kim Cameron World.” The soft-spoken Microsoft identity
architect has taken the world (or, at least, that small corner
of the world populated by those of us who think identity is key)
by storm with his promulgation of the Seven Laws of Identity
(link to Cameron's identity blog below).

Not only was his session on the laws filled to overflowing by
those eager to understand their nature, but also the laws were
the central theme of Burton Group CEO Jamie Lewis’ opening
keynote and Linux Journal Editor Doc Searls’ closing summary.
Cameron also walked away with a Digital ID World award.
According to the show organizers, the awards are “…dedicated
to recognizing those individuals or organizations that have made
a significant contribution (technology, policy or social) to the
digital identity industry.”

Cameron's contribution goes well beyond the content of the laws
themselves. He's fostered, almost single-handedly, a constant,
globe-circling conversation taking place not only in the
metaverse of the blogosphere (where the “listener” sometimes
feels they're at a virtual tennis match as they snap back and
forth from one blog to another) but also in the physical world
where any two or more people with an interest in defining
identity (and identity solutions) gather.

In the lobbies of the San Francisco Hyatt Regency, you could see
and hear small groups of attendees talking about one law or
another, what it might mean or where it might lead. In the
almost 20 years that I've been involved with identity, this is
the most exciting event to have occurred.

I urge all of you to get involved in this conversation. For
consumers of identity products, the seven laws give you the
foundation for the questions to ask of any vendor looking for
your business. For vendors, the laws provide a working context
for designing the next version of your products and services.
For all of us, the laws force us to look at our own beliefs
about identity and re-think them. Get involved in these
conversations or risk being left behind.

Eric Norlin on the Mysterious Law 7

In his post today, Eric Norlin of Ping gets right to the essence of the seventh law:

So *everyone* was talking about Kim's laws at last week's show, but one aspect of the whole thingy (btw – a “thingy” is totally different than “thingifying” something 😉 that really stuck with me is the Mysterious Law 7 (or something containted within it):

7. Consistent Experience Across Contexts

The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.

At first glance (or mine at least), i thought this was just about user interfaces – and i admit to not quite getting it…but hey – by the time you've made it through 6 laws you're exhausted – you don't care what they slip by you on law 7! 😉

Yes, this is indeed a problem.

Buried within law 7, however, may be the most significant thing about the laws — the fact that for the first time in identity technologies we're aiming for something that spans *both* the enterprise and end-user. (quoting Jamie quoting Inigo Montoya) Lemme sum up:

In the short history of identity technologies, there has generally been 2 universes: the end user and the enterprise. Think firefly (aka passport) vs. the metadirectory. the closest attempt we've really had is the Liberty Alliance's work (SAML is admittedly not a “user facing” technology) — but frankly, it just hasn't caught on with the “end-user” (does it violate a law? dunno – that's a totally different conversation).

In the metasystem we have, for the first time, a unifying construct that A) solves enterprise problems and is necessary and B) becomes an incredibly powerful end-user facing technology. The vehicle for this is WS-Trust; the now oft-called “STS” or “secure token service” — what i've taken to calling “project cadillac.”

In essence, the STS exchanges tokens within the enterprise “onion layers” of security, thus enabling the use of identity tokens all the way back into the fossilized layers of mainframe security. Simultaneously, the STS exchanges tokens as the user moves throughout his/her differing domains.

I don't think i can emphasize *how* important this is…..this isn't the “mosaic” moment (where we realize the internet's potential by seeing it), but it is an important point of coalescence that surely is closely related to the mosaic moment (big bang) for identity. Digital Identity has not had this available before, and this convergence should not be underestimated.

Law 7 says that the metasystem really can be distributed, belong to no one, AND unifying and universal. No more sith (enterprise) vs. jedi (end user) – this could become the end of Return of the Jedi (without the ewoks, hopefully).

so – that's what i learned last week — how HUGE law 7 is……..

could we really be on the cusp of something big? god, i hope so.

Exactly. Enterprise identity systems normally”deal with” employee end-users – who go home at night and jump into consumer-to-enterprise and even peer-to-peer identity relationships. If we stop tying UX and protocols to these various silos, we can imagine that a user-centric paradigm would replace the scenario-specific paradigm. A user-centric identity paradigm could remain consistent across these various scenarios, resulting in portability of understanding across them. This is just one example of what happens when identity systems begin to benefit from synergy – the magical ingredient which has so far remained just beyond their reach.

My readers know how hard it was for me to name the seventh law and put it into words. The implications of introducing synergy are huge. With a little help from our friends we've been able to get closer to the bone and jettison a bunch of verbiage. Eric's contribution here makes it clearer still.