Cloud Foundry: Design and Architecture
Derek Collison discusses the goals, the design premises and patterns employed in creating the architecture of Cloud Foundry, VMware’s open source PaaS, unveiling internal architectural details.
News
The content has been bookmarked!
There was an error bookmarking this content! Please retry.
Goodbye, CardSpace; Hello, U-Prove!
Posted by James Plamondon on Feb 23, 2011
Last week, Microsoft announced:
- The cancellation Version 2.0 of its Windows CardSpace identity service, thus deprecating CardSpace; and
- The immediate availability of Release 2 of the Community Technology Preview of its U-Prove identity service.
These announcements are just the latest moves in Microsoft's decade-long struggle to solve the Internet's "identity problem."
One aspect of the identity problem is unified login: the ability to log into any compliant website using credentials from (say) Google, facebook, MSN, eBay, etc.
Without unified login, you have to come up with a unique username and password combination for every website registration. If you use the same username/password credentials on more than one website, your exposure to identity theft is higher. For example, if your username/password credentials were stolen from Gawker, and you used that same username/password combination on other websites, then you could be impersonated on those other websites, too.
This is not Microsoft's first dance with "unified login." A decade ago, it proposed its much-criticized Hailstorm/Passport system, in which only Microsoft could act as an identity provider—that is, only Microsoft could issue username/password credentials, and all relevant personal information was stored centrally by Microsoft. Although this system formed the basis of today's Windows Live ID, its centralized and proprietary characteristics prevented its wider adoption.
In response, Microsoft delivered CardSpace as the client of a "federated" identity management system, in which many different entities could, in theory, act as back-end identity providers. However, Microsoft didn't make it easy for other identity providers to participate in the federated system. As Microsoft's identity guru, Kim Cameron, stated in 2008, "We've tortured developers. We ourselves didn't have any server software that would work with it. There was no product on the back end." Microsoft's Windows Identity Foundation (née Geneva Server, née Zermatt, with its first beta in 2008) lowered this barrier, and its Active Directory Federation Services 2.0, released in May 2010, lowered the barrier even more.
Still, CardSpace was not widely adopted outside of Microsoft's Internet Explorer browser, and other problems became clearer over time. To quote this week's blog post that officially announced CardSpace's deprecation:
"Windows CardSpace was initially released and developed before the pervasive use of online identities across multiple services. Perhaps more importantly, we released the user component before we and others had delivered the tools for developers and administrators to easily create claims-ready services. The identity landscape has changed with the evolution of tools and cloud services."
That same blog post went on to describe Microsoft's U-Prove system as "a user agent that takes account of cloud computing realities and takes advantage of the high-end security and privacy capabilities within the extended U-Prove cryptographic technology," which Microsoft acquired from Credentica in 2008.
The other primary criticism of Microsoft's previous efforts was their closed-source, proprietary nature. Microsoft has attempted to address this by offering its U-Prove CTP SDKs (in C# and Java) under the Apache 2.0 open-source license, with patent rights granted under Microsoft's Open Specification Promise.
The market opportunity for a Microsoft-driven approach may wider than it was a year ago, because the leading open standard for unified login, OpenID, has recently been widely criticized as having actually made things worse for both users and developers.
One of the major advantages of a federated approach (of which Microsoft's is just one example; the open-source Higgins Project is another) is that it can offer additional benefits beyond unified login, such as minimal disclosure, unlinkability, and untraceability. These features have the potential to significantly increase online privacy and security.
On the one hand, those who profit from tracking online activity could see these limitations as a significant downside, slowing their adoption of a federated system. On the other hand, consumers love these limitations, and politicians are starting to listen. Late last year, the Obama Administration's Commerce Department issued a report calling for "increase[d] protection of consumers' commercial data," in ways that could be easily addressed through use of a federated system. The European Union is considering similar moves.
Large commercial enterprises, too, have much to gain from the use of a federated identity model. Security remains one of the biggest issues blocking enterprise migration to the cloud. While identity management is just one aspect of cloud security, its resolution could be a big step in the right direction.
The wheels of legislation grind even more slowly than those of large enterprises, however, so neither Microsoft nor anyone else should count on legislation to drive the word towards federated identity management anytime soon. Even if such legislation were to pass tomorrow, Microsoft's technology might not prove to be the best available. However, it has the virtue of being available today, at least in CTP form.
Conclusion: If your .NET-based website requires logon, take a look at the just-released U-Prove CTP, to see if its services meet your website's needs.
RelatedVendorContent
Troubleshoot Java/.NET performance while getting full visibility in production
Identity and Access Management for Cloud Apps: A Buyer's Guide
Want to know how software releases can be stress-free and happen with one click? Try Go free!
Improving Software Delivery Cycles: Pre-requisites and Inhibitors
Related Sponsor
Go: Agile Release Management Solutions. Go enables predictable, defect-free and timely software releases.
And the problem still remains
by
Francois Ward
Posted
We need to take control
by
Mike Gale
Posted
Re: We need to take control
by
Mike Gale
Posted
-
The reason why all these things never picked up from Microsoft, is that its a moving target. They changed tech so often, the odds aren't exactly in my favor if I adopt one of them that I won't have to explain to my boss in a few years that support got dropped.
Not worth the risk: the problem here isn't a technical one. -
I had a look at the U-Prove web site. After a number of false starts I didn't have my questions answered. (No forum found, horrible PDF... position papers instead of honest to goodness web pages.) After spending time looking at and trying to use Hailstorm, Cardspace, Web-of Trust... I'm not convinced this'll work either.
The thought of Facebook as logon is not for me.
So what is the answer?
For me, part of it is having my own system, no third parties getting in the way (and making it less reliable). Something I run on my own machines. Something that can invoke outside services whenever I need them. Something that carries more of the administrative burden without loss of control. Something that doesn't assume I'm a completely docile, ignoramus...
Maybe something can be forged from the CTP code, but I really hoped that the heavy lifting (for this approach) would have been done already!!
There's a commercial provider of "smart cards" hanging around in the background here. All too often such guys impact decisions that eventually scupper the technology. -
There is some information which seems good about the technology. It's a 6 chapter online book, freely downloadable.
www.credentica.com/the_mit_pressbook.html
A lot to digest!
3 comments
Watch Thread Reply