{"id":724,"date":"2007-03-25T12:28:22","date_gmt":"2007-03-25T20:28:22","guid":{"rendered":"\/?p=724"},"modified":"2007-03-25T12:50:00","modified_gmt":"2007-03-25T20:50:00","slug":"delegation-tokens-and-impersonation","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=724","title":{"rendered":"Delegation tokens and impersonation"},"content":{"rendered":"

I've been asked to clarify a couple of points by Devlin Daley and Bryant Cutler, who are studying with Phil Windley<\/a>.<\/p>\n

Delegation tokens<\/strong> <\/p>\n

Delegation tokens, as you've described them, (according to one of Dale Old's recent posts<\/a>) are not yet implemented in CardSpace.  Is that accurate? Is it soon to be added to specification or is it still a work in progress?<\/p><\/blockquote>\n

I like Dale's piece, but think the “not yet implemented” statement might lead to confusion. <\/p>\n

One of the key characteristics of CardSpace is that it has no idea what kind(s) of token it is carrying.  It's hard to get this across – the practical meaning isn't obvious.  But your question about “delegation tokens” provides  a good concrete example:  delegation coupons can be conveyed through CardSpace without any changes or extensions to it.  This doesn't mean anyone is doing so yet.  That is likely what Dale is talking about. <\/p>\n

I've actually been thinking of putting together some demo code to show how this would work.  If you look at my “HelloWorld Card” tutorial<\/a>,  you will see that rather than requesting and sending a “HelloWorld Card”, the relying party could easily be requesting a delegation coupon.  So CardSpace is actually ready for “delegation coupons”.<\/p>\n

One can then ask what a delegation coupon would look like in concrete terms.  What's the best format for the (possibly multiple) constituent tokens?  The blogosphere discussion about delegation shows lots of people are thinking about this, but so far we haven't built the “early implementations” that let us explore the issues and problems concretely enough to emerge with a new standard.  I would be interested in learning about research systems built in the academic community to explore this territory – perhaps you can share your research with us.<\/p>\n

Impersonation<\/strong><\/p>\n

Devin and Bryant continue:<\/p>\n

We've been bantering about the idea of delegation vs. impersonation. Clearly impersonating someone without them knowing is wrong and a serious problem. But, is impersonation “bad” if I give my express permission for someone to do so? (assuming there is a mechanism for revoking this permission).<\/p>\n

In your Powell's and Amazon example, what if I don't want Powell's to know that I am supplying this information to Amazon? Obviously there are cases where we want to let others know that services are acting with our permission. Perhaps there are cases where we don't want to disclose that. Is granting the choice to me more user-centric?<\/p><\/blockquote>\n

You are quite right that, as per the first law of identity<\/a>, the choice of what to disclose must always be in the hands of the user.  Further, if a user wants to delegate to a machine the ability to “be her”, that should be possible too.  Let's call it extreme delegation<\/strong>.  Our job is not to tell anyone that they should live in some particular way.  We might, however, have the responsibility of pointing out the technical dangers of this extreme, perhaps even recommending some interesting science fiction readings…<\/p>\n

But I'll point out that it isn't necessary to do impersonation to achieve the goal you want to achieve in your example – preventing Powell's from knowing that you are supplying information to Amazon.  In fact there are two ways to use delegation to do this. <\/p>\n

The first is simply to create a coupon saying, “the holder of this key has the right to see my Powell's behavior”.  Then you give Amazon the coupon and the key.  In return, Amazon might give you assurances about how it will protect the coupon.  Meanwhile, it can retrieve the information it wants without revealing its identity.<\/p>\n

Or you may wish to have an agent of your own to which you delegate the ability to assemble your behaviors, and the right to pass them on according to your dictates.  I personally think this is the most likely option since it provides optimal user control.  But even in this case, designing secure systems means limiting the capabilities delegated to that particular piece of software, rather than “making it into you” by having it operate in your identity.  There is zero need for impersonation.<\/p>\n

Your use case of information hiding can be handled without departing from my delegation maxim<\/a>:<\/p>\n

No one and no service should ever act in a peron\u00e2\u20ac\u2122s identity or employ their credentials when they\u00e2\u20ac\u2122re not present.<\/em>  Ever.  <\/p><\/blockquote>\n

Putting several threads together, the user should act through a transducer to delegate to well-identified processes.<\/p>\n","protected":false},"excerpt":{"rendered":"

The user should act through a transducer to delegate to well-identified processes.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[32,6,17,8,11,5],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/724"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=724"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/724\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}