1. © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 | 2009-03-24 Identity Management in Your RCP Application with Higgins Mary Ruddy, Manfred Duchrow, Frank Gerhardt Jochen Hiller, Gunnar Wagenknecht,

2. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Agenda Higgins – an Introduction > Higgins Examples > Higgins 1.1 > Higgins 1.1 – Beyond >

3. Higgins 1: A species of Tasmanian long-tailed mouse 2: An open source identity framework being developed at the Eclipse Foundation

4. Sections 1.Higgins 1.0 – What we released in Feb 2008 2.Higgins 1.1 – What we’re working on (or in some cases just thinking about) for June 2009 3.Beyond Higgins 1.1 Copyright © 2008 Parity. Made available under EPL 1.04

5. Section One: Higgins 1.0 Released February 2008 Commercial products based on Higgins 1.0 have been announced by Novell, Serena, Computer Associates and IBM Copyright © 2008 Parity. Made available under EPL 1.05

6. Higgins is an Identity Framework Enables users and applications to integrate identity, profile, and social relationship information across multiple data sources and protocols. 6Copyright © 2008 Parity. Made available under EPL 1.0

7. End-users experience Higgins through the UI metaphor of Information Cards using an app called an Identity Selector Information Cards and selectors are just tip of the iceberg of what can be done with Higgins, but it’s a place to start… 7Copyright © 2008 Parity. Made available under EPL 1.0

8. Today you go from site to site filling in forms and passwords Copyright © 2008 Parity. Made available under EPL 1.08 Type, type, type. Click, click. Here a password, there a password. Everywhere a password. Here a form, there a form,... Websites…

9. Information Cards Put You in Control Copyright © 2008 Parity. Made available under EPL 1.09 Each card is a slice of the digital you (or a friend of yours) held in some data silo. Any kind of information: your preferences, favorite songs, employee id numbers, drivers licenses, affiliations, your health plan id,...you get the idea, can be accessed using a card. This wallet-like thing is an app called an Identity Selector

10. Higgins Identity Selectors Copyright © 2008 Parity. Made available under EPL 1.010 Identity Selectors Identity Attribute Service Identity Provider s Relying Parties Client Apps, Web Services, Web apps Identity Services Identity Provider s Identity Selectors

11. How to Use I-Cards By clicking on a card you can log into sites. No more passwords You can share cards with friends and businesses you trust Some [relationship] cards create permanent connections to your friends, communities and businesses 11

12. Click Identity Selector “Wallet” Click on a card to send it to a site Copyright © 2008 Parity. Made available under EPL 1.012 Higgins is interoperable with Microsoft CardSpace™ shown here

13. Identity Selector Card-based Sign-in Per-site passwords are eliminated Instead, the selector posts a security token that is validated by the relying site Provides some anti-phishing protection Copyright © 2008 Parity. Made available under EPL 1.013

14. Identity Selector Supported Card Types Copyright © 2008 Parity. Made available under EPL 1.014 Managed What some other entity says about you Personal What you say about you

15. Identity Selectors Three Flavors in Higgins 1.0 Firefox-embedded Selector (Javascript) – For Firefox on Windows, Linux, and OSX – Uses hosted I-Card Service Component GTK / Cocoa Selector (C++) – For Firefox on Linux, FreeBSD, and OSX – Available as DigitalMe™ from Novell RCP Selector (Java) – For Eclipse RCP Application 15Copyright © 2008 Parity. Made available under EPL 1.0

16. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Higgins Examples > RCPMail Demo – Extension as Multi user application  > RCPMail Demo – “Classic extension with username/password based login” RCPMail Demo – Use the RCP Identity Selector > RAPMailDemo – Acts as relying party, provide web based identity selector  Demonstrate with FF embedded selector  Demonstrate with Native Client (Cocoa) Add an IdP to your applicaton – registration example

17. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Higgins Examples > HowTo – Setup RCP based Identity Selector

18. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Architecture slides for demo

19. Identity Selectors Cards and Tokens Flow Identity Selector Browser Extension & Client App Identity Provider Relying Party Website or App Cards are generated and downloaded from here. A local Token Service issues tokens as requested by Selector. Cards are stored and selected here Tokens containing claim data is requested and received here

20. Identity Selectors Cards and Tokens Flow Identity Selector Browser Extension & Client App Identity Provider Relying Party Some Higgins Identity Selectors rely on a hosted I-Card Service component

21. User Identity Provider Relying Website Token Service Browser Browser Extension Identity Selector Internet Key: Generic Technology Higgins Components Identity Selector Component View RP Libraries Selector Higgins Identity Selectors. Client apps for Windows, OSX and Linux I-Card Web Service

22. User Identity Provider Relying Website Token Service Browser Browser Extension Identity Selector Internet Key: Generic Technology Higgins Components Identity Selector Selector Selector – Component View RP Libraries Selector Higgins includes a Higgins Selector Selector component (Windows-only) Provides an abstraction layer that decouples browser extensions from selectors. I-Card Web Service

23. Architecture Identity Providers Copyright © 2008 Parity. Made available under EPL 1.023 Identity Selectors Identity Provider s Relying Parties Client Apps, Web Services, Web apps Identity Provider s Identity Selectors Identity Attribute Service Identity Services

24. Identity Provider Relying Website Token Service Browser Browser Extension Identity Selector Internet Key: Generic Technology Higgins Components Identity Providers Component View 24 RP Libraries Selector Higgins Token/IdP Service is used by the Identity Provider website User

25. Architecture Relying Party Website Copyright © 2008 Parity. Made available under EPL 1.025 Identity Selectors Identity Provider s Relying Parties Client Apps, Web Services, Web apps Identity Provider s Identity Selectors Identity Attribute Service Identity Services

26. Identity Provider Relying Website Token Service Browser Browser Extension Identity Selector Internet Relying Party Website Component View 26 RP Libraries Selector Higgins RP Website provides code to validate tokens from Identity Selectors Key: Generic Technology Higgins Components User

27. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Higgins 1.1

28. Section Two: Higgins 1.1 June 2009 Copyright © 2008 Parity. Made available under EPL 1.028

29. AIR-Based Selector Based on Adobe AIR – Integrates with Firefox, IE, and Safari – Runs on Windows, OSX and soon Linux – More secure Replaces the Firefox-embedded selector Copyright © 2008 Parity. Made available under EPL 1.029

30. Identity Attribute Service Access Control Enhancements Policy query API Policy management API Policy semantics modeled directly as Policy Entities and attributes Copyright © 2008 Parity. Made available under EPL 1.030

31. Identity Attribute Service New Context Providers Google Contacts Open Social Facebook F8 Wrappers for various ID-WSF services (maybe) Copyright © 2008 Parity. Made available under EPL 1.031

32. Identity Attribute Service XDI Protocol Support XDI Engine provides a new binding for the IdAS Service – Allows any/all attribute data managed by IdAS to be exposed as an XDI data service XDI Context Provider – Allows IdAS to read/write XDI-native data sources Copyright © 2008 Parity. Made available under EPL 1.032

33. Relationship Cards Relationship Card What you and Best Buy say about you 33Copyright © 2008 Parity. Made available under EPL 1.0

34. Relationship Cards Human Friendly Data References Card holds a UDI (URI) reference: – A ContextId that identifies a data source, and – A local EntityId object within the context See http://parity.com/udi Copyright © 2008 Parity. Made available under EPL 1.034 Data object (called an Entity )

35. Relationship Cards Data Location and Authority Best Buy issued card Entity is stored in Best Buy’s data center Best Buy is authoritative over some attributes You are authoritative over some attributes (e.g. street address) Copyright © 2008 Parity. Made available under EPL 1.035

36. Relationship Cards Data Model The Entity is described by the Higgins Context Data Model Can be accessed using the Identity Attribute Service 36Copyright © 2008 Parity. Made available under EPL 1.0

37. Other New Card Types Username/Password Card – To log in to traditional un/pw sites SAML Card (aka S-card) [maybe] – Uses SAML protocol to retrieve token Idemix card (aka Z-card) [maybe] – Support for a new privacy-enhancing token type based on zero-knowledge proofs – Improved support for selective disclosure Copyright © 2008 Parity. Made available under EPL 1.037

38. OpenID Provider Identity Provider Relying Website I-Card Web Service Token Service Browser Browser Extension Identity Selector Internet Key: Generic Technology Higgins Components Selector as an OpenID Service 38 RP Libraries Selector OpenID 2.0 OP with associated Higgins Selector Service User

39. ID-WSF Support (maybe) There have been some recent, focused discussions on the integration of Higgins and ID-WSF Higgins I-Card Service could implement: – ID-WSF Discovery Service – ID-WSF Authentication Service (I think) Higgins Context Providers would be written for various ID-WSF services Integration with R-Cards and XRDS Would rely on the OpenLiberty.org code base Copyright © 2008 Parity. Made available under EPL 1.039

40. IdAS Client Component (maybe) 40

41. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Higgins 1.1 - Beyond

42. Section Three: Beyond Higgins 1.1 Mobile Higgins Higgins project is seeking project funding and/or contributions to develop a Higgins selector for mobile platforms Copyright © 2008 Parity. Made available under EPL 1.042

43. Target Platforms Symbian RIM Windows Mobile 6 iPhone Android Copyright © 2008 Parity. Made available under EPL 1.043

44. Paul Trevithick Mary Ruddy paul@socialphysics.org mary@socialphysics.org +1.617.513.7924 +1.617.290.8591 Project Co-leads http://higgins-project.org Copyright © 2008 Parity. Made available under EPL 1.044

45. Identity Management in Your RCP Application with Higgins | © 2009 by Mary Ruddy, Manfred Duchrow, Frank Gerhardt, Jochen Hiller, Gunnar Wagenknecht; made available under the EPL v1.0 Backup slides - unsorted

46. Identity Providers Two Flavors WS-Trust Security Token Service / IdP – Java WS-Trust Identity Provider – Web service – Sample web site SAML2 IdP – Java SAML2 Identity Provider – Web service Copyright © 2008 Parity. Made available under EPL 1.046

47. Relying Party Website Multi-Protocol Support Multi-Protocol Relying Party Website Enablement – Information Card authentication – OpenID authentication Copyright © 2008 Parity. Made available under EPL 1.047

48. Architecture Identity Services Copyright © 2008 Parity. Made available under EPL 1.048 Identity Selectors Identity Attribute Service Identity Provider s Relying Parties Client Apps, Web Services, Web apps Identity Services Identity Provider s Identity Selectors

49. Architecture Extensible Identity Services Copyright © 2008 Parity. Made available under EPL 1.049 CardSpace Protocol Provider-Plugins Implement RP protocols OpenID Managed I-Card Provider-Plugins Implement card types Personal SAMLX509 Relationship Kerberos Token Provider-Plugins Implement security tokens UN/PWIdemix Plug-ins Identity Services Login (un/pw) Key: Beyond Higgins 1.0 Higgins 1.0

50. Architecture Identity Attribute Service Copyright © 2008 Parity. Made available under EPL 1.050 Identity Selectors Identity Attribute Service Identity Provider s Relying Parties Client Apps, Web Services, Web apps Identity Services Identity Provider s Identity Selectors

51. Architecture Extensible Identity Attribute Service Copyright © 2008 Parity. Made available under EPL 1.051 Identity Attribute Service (IdAS) LDAPXML File IdAS Context Providers-Plugins Connect to existing data sources RDF Google Contacts Others… Plug-ins Key: Beyond Higgins 1.0 Higgins 1.0

52. Identity Attribute Service The Context Data Model is implemented by Identity Attribute Service Contexts may be accessed using IdAS may employ a variety of authentication approaches The contained Entities may be inspected, navigated and or modified based on authorization policy of the Context IdAS is extended by Context Providers (plugins) Context Providers map existing data sources into the Higgins Context Data Model Copyright © 2008 Parity. Made available under EPL 1.052

53. Identity Attribute Service Context Data Model (CDM) Data sources are called Contexts – E.g. enterprise directories, social networks, RDF repositories Contexts contain objects called Entities – Entities represent people, organizations, etc. Entities have Attributes ; Attributes have values The core semantics of the model are based on RDF & OWL Copyright © 2008 Parity. Made available under EPL 1.053

54. Identity Attribute Service CDM extends RDF Globally linked data – Higgins uses UDIs not just HTTP URIs – Some EntityId UDI ids may be globally resolved into a global object graph Supports protocols beyond HTTP – Uses XRDS discovery of UDI endpoint metadata, including protocol for data access Read and write access – Access Control management & enforcement Copyright © 2008 Parity. Made available under EPL 1.054

55. Architecture Interoperability Points Copyright © 2008 Parity. Made available under EPL 1.055 Identity Selectors Identity Attribute Service Identity Provider s Relying Parties Client Apps, Web Services, Web apps Identity Services Identity Provider s Identity Selectors

56. Interoperability Event Participants RSA 2008 56Copyright © 2008 Parity. Made available under EPL 1.0

57. Interoperability Event Participants RSA 2008 57Copyright © 2008 Parity. Made available under EPL 1.0

58. Appendix Original Project Goals 58Copyright © 2008 Parity. Made available under EPL 1.0

59. Goals: 1 of 5 Provide a consistent user experience based on card icons for the management and release of identity data This is needed in order to have a trusted mechanism for authentication and other interactions that is less vulnerable to phishing and other attacks and that works for a wide variety of users and systems See Higgins 1.0 Identity Selector 59Copyright © 2008 Parity. Made available under EPL 1.0

60. Goals: 2 of 5 Empower users with more convenience and control over personal information distributed across external information silos Provide a single point of control over multiple identities, preferences and relationships See Higgins 1.0 Identity Selector 60Copyright © 2008 Parity. Made available under EPL 1.0

61. Goals: 3 of 5 Provide an API and data model for the virtual integration and federation of identity and security information from a wide variety of sources See Higgins 1.0 Framework 61Copyright © 2008 Parity. Made available under EPL 1.0

62. Goals: 4 of 5 Provide plug-in adapters to enable existing data sources including directories, communications systems, collaboration systems and databases each using differing protocols and schemas to be integrated into the framework See Higgins 1.0 Identity Attribute Service and Context Providers (plugins) 62Copyright © 2008 Parity. Made available under EPL 1.0

63. Goals: 5 of 5 Provide a social relationship data integration framework that enables these relationships to be persistent and reusable across application boundaries It organizes relationships into a set of distinct social contexts within which a person expresses different personas and roles See Higgins 1.0 Context Data Model (CDM) 63Copyright © 2008 Parity. Made available under EPL 1.0