1. Who’s Managing That Identity?
Spring 2008 CHECO

2. Person vs. User Person User Has a body and a mind? Name
Address/phone #
Student ID/Employee ID
Major/Job Class & Department
Address
Is an application concept
Name (login)
Application Specific Authorizations
Application specific attributes

3. Authority? Person User Business Process: HR, Registrar
Maintained by: HR Admin, Registrar’s Office, Self
System of Record: HR, SIS
Business Process: Application owner
Maintained by: Application Admin
System of Record: Application

4. Delegation? Person User Bio/Demographic (incl. email) Tax ID
Authentication
Creation/Deletion
Role management (to a person system?)
Application attributes (share; or at least store externally)
Authorization policy

5. “Overloaded” Concepts
“Guest”
Expiration
Level of Assurance
Role
Directory

6. Awkward Feature Tangle
Person systems of record assume each “person” record represents a system user
AND
Identity management systems primarily concerned with user provisioning treat each user as a person (bootstrap problem)

7. (Shifting Gears Slightly) Upstream Convergence
CardSpace; OpenID; Higgins Project
Identity Service Providers:
Bio/Demographic Data
Authentication
Allows for application specific (or relationship specific) attribute passing

8. The future from 2005 Do you know Dick? Microsoft says what?!?
Dick Hardt Defines “Identity 2.0”
Microsoft says what?!?
Kim Cameron’s Laws of Identity and the Identity Metasystem

9. Raises More Questions Are we identity service providers?
What level of trust do we accept?
Do we want our identity attributes in a “walled garden”?
Person attributes; user attributes; both?
What about Shibboleth (SAML)?
Will our vendors “get it”?