Distributed SSO Cédric Hüsler CTO
local.ch Google TechTalk Zürich - April 2007

Quick Poll Who always use
the same PW for every new account on a new site? Who has a blog? Who has an OpenID?

BA BA SII SC CS
prove you are really who you suppose to be S Authentication Username & Password Challenge-response Public-Private Key vs. what are you allowed to do Authorization ACL (Access Control List) RBAC (Role-based Access Control)

BA BA SIIC S CS
ability to uniquely identify yourself S Identity Your Name AHV-Nr / SSN Fingerprint vs. ability to control what others know about you Privacy Can you keep a secret? Virtualization Opt-in

BA BA SII SC CS
how much can I depend on you? S trust vs. control how much information am I going to give?

BA BA SII SC CS
S SSO Single-Sign-On   using the same automatic credentials to access authentication beyond multiple services session and service

= Authentication Delegation = Identity
Manager = Open API ≠ Authentication ≠ Trust

Use a URL as user
name! I own the domain: keepthebyte.ch - why not using it as user name?

Time for
demo!
http://jyte.com/

Login Process Overview Download at
http://www.flickr.com/photos/keepthebyte/347821691/

...with trusted site auto login
on the identity provider

HTTP Level - Part 1/3
User Agent <> RP GET: %site%/login.html POST: %site%/login with OpenID RP <> IdP GET: openid url