Infrastructure Team/Central Login - Revision history

FGrose: discussion link

2011-10-19T16:47:22Z

discussion link

← Older revision		Revision as of 12:47, 19 October 2011
Line 1:		Line 1:
	== Summary ==		== Summary ==

	This is initiative to permit a user to access multiple SL resources while providing their credentials (such as userid and password) only once.		This is an initiative to permit a user to access multiple SL resources while providing their credentials (such as userid and password) only once.

	== Benefits ==		== Benefits ==
Line 64:		Line 64:
	* Push this new infra to production usage;		* Push this new infra to production usage;
	* Look for more auth methods, like certs based auth from Sugar Shell, that might be useful in addition to the existing system.		* Look for more auth methods, like certs based auth from Sugar Shell, that might be useful in addition to the existing system.
			=== Discussion ===
			[http://www.mail-archive.com/sugar-devel@lists.sugarlabs.org/msg23290.html sugar-devel thread]

Alsroot: /* Motion */

2011-10-19T00:54:36Z

Motion

← Older revision		Revision as of 20:54, 18 October 2011
Line 63:		Line 63:
	* If particular site supports OpenID as a second auth method, use it as a second auth scheme with CAS;		* If particular site supports OpenID as a second auth method, use it as a second auth scheme with CAS;
	* Push this new infra to production usage;		* Push this new infra to production usage;
	* Look for more auth methods, like certs based auth from Sugar Shell, that might be useful ~~as well~~.		* Look for more auth methods, like certs based auth from Sugar Shell, that might be useful in addition to the existing system.

Alsroot at 00:47, 19 October 2011

2011-10-19T00:47:56Z

← Older revision		Revision as of 20:47, 18 October 2011
Line 53:		Line 53:
	* Have a "Forgot password" feature.		* Have a "Forgot password" feature.
	* Edit LDAP metadata. It would be useful to let people authenticate on CAS, i.e., to avoid typing passwords twice, once to get access to a service and a second time in Account management applications before editing account metadata.		* Edit LDAP metadata. It would be useful to let people authenticate on CAS, i.e., to avoid typing passwords twice, once to get access to a service and a second time in Account management applications before editing account metadata.

			== Motion ==

			Basing on Infrastructure Team discussion, there is a motion:

			* Central [[wikipedia:Lightweight_Directory_Access_Protocol \|LDAP]], i.e., centralized database of all users;
			* Support [[wikipedia:Central_Authentication_Service\|CAS]] on as many as possible Sugar Labs sites;
			* Having users friendly (not only for geeks) [[#Account management application\|Account management application]];
			* If particular site supports OpenID as a second auth method, use it as a second auth scheme with CAS;
			* Push this new infra to production usage;
			* Look for more auth methods, like certs based auth from Sugar Shell, that might be useful as well.

FGrose at 20:12, 5 October 2011

2011-10-05T20:12:19Z

← Older revision		Revision as of 16:12, 5 October 2011
Line 8:		Line 8:
	* Centralized users database.		* Centralized users database.
	* Reuse users database not only for Web services, but also for shell accounts, for example.		* Reuse users database not only for Web services, but also for shell accounts, for example.
			* (a side-benefit) Education about the risks of inter-networked services. Most people have little understanding of such risks, their significance, or appropriate protective behaviors.

	== Costs ==		== Costs & Risks==

	* To be accounted.		* To be accounted.
Line 16:		Line 17:
	*: This point belongs to [[#Benefits\|Benefits]] as well, e.g., if most of our services will use CAS, we will have only one, well controlled, access point. --[[User:Alsroot\|alsroot]] 13:40, 28 September 2011 (EDT)		*: This point belongs to [[#Benefits\|Benefits]] as well, e.g., if most of our services will use CAS, we will have only one, well controlled, access point. --[[User:Alsroot\|alsroot]] 13:40, 28 September 2011 (EDT)
	*:: There is an escalating intrusion/protection arms race on the Internet that challenges the most advanced providers of ethical services. Yes, we should seek to benefit from those efforts. --[[User:FGrose\|FGrose]] 13:34, 5 October 2011 (EDT)		*:: There is an escalating intrusion/protection arms race on the Internet that challenges the most advanced providers of ethical services. Yes, we should seek to benefit from those efforts. --[[User:FGrose\|FGrose]] 13:34, 5 October 2011 (EDT)
			* What risks are there after signing on from a public workstation and leaving one's authentication cookie behind, or otherwise loosing one's cookie? What responsible efforts should we undertake to get the vulnerable community to participate more safely?

	== Resources to authenticate on ==		== Resources to authenticate on ==

FGrose at 17:34, 5 October 2011

2011-10-05T17:34:57Z

← Older revision		Revision as of 13:34, 5 October 2011
Line 12:		Line 12:

	* To be accounted.		* To be accounted.
	** Be counted is a sign-less instrument, the ~~sing~~ depends on an intention (SL here is out of suspicions) and doers' professionalism (yep, ~~thats~~ the question). And for not being counted, there is only one option - not being counted anywhere, i.e., out of Login usecase at all. --[[User:Alsroot\|alsroot]] 12:46, 28 September 2011 (EDT)		*: Be counted is a sign-less instrument, the sign depends on an intention (SL here is out of suspicions) and doers' professionalism (yep, that's the question). And for not being counted, there is only one option - not being counted anywhere, i.e., out of Login usecase at all. --[[User:Alsroot\|alsroot]] 12:46, 28 September 2011 (EDT)
	* Different authentication methods provide different levels of protection from those who wish to abuse Sugar Labs resources. While making it easier to participate, we will likely suffer some abuse during the interim, until we, or the industry, learn to better filter those with ill intentions. --[[User:FGrose\|FGrose]] 13:26, 28 September 2011 (EDT)		* Different authentication methods provide different levels of protection from those who wish to abuse Sugar Labs resources. While making it easier to participate, we will likely suffer some abuse during the interim, until we, or the industry, learn to better filter those with ill intentions. --[[User:FGrose\|FGrose]] 13:26, 28 September 2011 (EDT)
	** This point belongs to [[#Benefits\|Benefits]] as well, e.g., if most of services will use CAS, we will have only one, well controlled, access point. --[[User:Alsroot\|alsroot]] 13:40, 28 September 2011 (EDT)		*: This point belongs to [[#Benefits\|Benefits]] as well, e.g., if most of our services will use CAS, we will have only one, well controlled, access point. --[[User:Alsroot\|alsroot]] 13:40, 28 September 2011 (EDT)
			*:: There is an escalating intrusion/protection arms race on the Internet that challenges the most advanced providers of ethical services. Yes, we should seek to benefit from those efforts. --[[User:FGrose\|FGrose]] 13:34, 5 October 2011 (EDT)

	== Resources to authenticate on ==		== Resources to authenticate on ==

Alsroot: /* Authenticate front-ends */

2011-09-28T17:44:16Z

Authenticate front-ends

← Older revision		Revision as of 13:44, 28 September 2011
Line 27:		Line 27:

	== Authenticate front-ends ==		== Authenticate front-ends ==

			A list of possible authenticate front-ends:

	* [[wikipedia:Central_Authentication_Service \|CAS]], the most common method, with a requirement to provide login/password, is useful for people who are not arriving from a Sugar Shell instance (and so, Sugar's certificate-based method does not work implicitly for them), and for casual visitors or those wishing to avoid the technical work of taking care of user side certificates. The full featured option.		* [[wikipedia:Central_Authentication_Service \|CAS]], the most common method, with a requirement to provide login/password, is useful for people who are not arriving from a Sugar Shell instance (and so, Sugar's certificate-based method does not work implicitly for them), and for casual visitors or those wishing to avoid the technical work of taking care of user side certificates. The full featured option.

Alsroot: /* Costs */

2011-09-28T17:40:52Z

Costs

← Older revision		Revision as of 13:40, 28 September 2011
Line 11:		Line 11:
	== Costs ==		== Costs ==

	* To be accounted. ~~<!--~~ Be counted is a sign-less instrument, the sing depends on an intention (SL here is out of suspicions) and doers' professionalism (yep, thats the question). And for not being counted, there is only one option - not being counted anywhere, i.e., out of Login usecase at all. [[User:Alsroot\|alsroot]] 12:46, 28 September 2011 (EDT) ~~-->~~		* To be accounted.
			** Be counted is a sign-less instrument, the sing depends on an intention (SL here is out of suspicions) and doers' professionalism (yep, thats the question). And for not being counted, there is only one option - not being counted anywhere, i.e., out of Login usecase at all. --[[User:Alsroot\|alsroot]] 12:46, 28 September 2011 (EDT)
	* Different authentication methods provide different levels of protection from those who wish to abuse Sugar Labs resources. While making it easier to participate, we will likely suffer some abuse during the interim, until we, or the industry, learn to better filter those with ill intentions. --[[User:FGrose\|FGrose]] 13:26, 28 September 2011 (EDT)		* Different authentication methods provide different levels of protection from those who wish to abuse Sugar Labs resources. While making it easier to participate, we will likely suffer some abuse during the interim, until we, or the industry, learn to better filter those with ill intentions. --[[User:FGrose\|FGrose]] 13:26, 28 September 2011 (EDT)
			** This point belongs to [[#Benefits\|Benefits]] as well, e.g., if most of services will use CAS, we will have only one, well controlled, access point. --[[User:Alsroot\|alsroot]] 13:40, 28 September 2011 (EDT)

	== Resources to authenticate on ==		== Resources to authenticate on ==

FGrose at 17:40, 28 September 2011

2011-09-28T17:40:23Z

← Older revision		Revision as of 13:40, 28 September 2011
Line 29:		Line 29:
	* [[wikipedia:OpenID \|OpenID]] authentication. Would be useful if particular service can link OpenID users and the ones got from CAS/LDAP. Without that, OpenID is just a standalone authentication method for particular service that does not relate to Central Login at all.		* [[wikipedia:OpenID \|OpenID]] authentication. Would be useful if particular service can link OpenID users and the ones got from CAS/LDAP. Without that, OpenID is just a standalone authentication method for particular service that does not relate to Central Login at all.
	* Users certificates. Might be useful, e.g., for people who need to be authenticated from a Sugar Shell where Sugar might perform some authentication routines under the hood.		* Users certificates. Might be useful, e.g., for people who need to be authenticated from a Sugar Shell where Sugar might perform some authentication routines under the hood.
	* ''Any method that can process authentication via LDAP, to reuse centralized users database only (no single sign-on)''.		* ''Any method that can process authentication via [[wikipedia:Lightweight_Directory_Access_Protocol \|LDAP]], to reuse centralized users database only (no single sign-on)''.

	== Authenticate back-end ==		== Authenticate back-end ==
Line 43:		Line 43:
	This application is needed to accomplish several tasks related to account management procedures for regular users, such as:		This application is needed to accomplish several tasks related to account management procedures for regular users, such as:

	* Let people create an account on LDAP server using regular, for Web services, Sign-on workflow, i.e., in automatic manner. ~~Would~~ be useful to have instruments to prevent automated software from performing registration.		* Let people create an account on the LDAP server using the regular, for Web services, Sign-on workflow, i.e., in an automatic manner. It would be useful to have instruments to prevent automated software from performing registration.
	* Have a "Forgot password" feature.		* Have a "Forgot password" feature.
	* Edit LDAP metadata. ~~Would~~ be useful to let people authenticate on CAS, i.e., to avoid typing passwords twice, ~~one time~~ to get access to a service and ~~the~~ second ~~one~~ in Account management ~~application~~ before editing metadata.		* Edit LDAP metadata. It would be useful to let people authenticate on CAS, i.e., to avoid typing passwords twice, once to get access to a service and a second time in Account management applications before editing account metadata.

FGrose at 17:26, 28 September 2011

2011-09-28T17:26:27Z

← Older revision		Revision as of 13:26, 28 September 2011
Line 12:		Line 12:

	* To be accounted. <!-- Be counted is a sign-less instrument, the sing depends on an intention (SL here is out of suspicions) and doers' professionalism (yep, thats the question). And for not being counted, there is only one option - not being counted anywhere, i.e., out of Login usecase at all. [[User:Alsroot\|alsroot]] 12:46, 28 September 2011 (EDT) -->		* To be accounted. <!-- Be counted is a sign-less instrument, the sing depends on an intention (SL here is out of suspicions) and doers' professionalism (yep, thats the question). And for not being counted, there is only one option - not being counted anywhere, i.e., out of Login usecase at all. [[User:Alsroot\|alsroot]] 12:46, 28 September 2011 (EDT) -->
			* Different authentication methods provide different levels of protection from those who wish to abuse Sugar Labs resources. While making it easier to participate, we will likely suffer some abuse during the interim, until we, or the industry, learn to better filter those with ill intentions. --[[User:FGrose\|FGrose]] 13:26, 28 September 2011 (EDT)

	== Resources to authenticate on ==		== Resources to authenticate on ==

Alsroot: /* Account management application */

2011-09-28T17:18:09Z

Account management application

← Older revision		Revision as of 13:18, 28 September 2011
Line 43:		Line 43:

	* Let people create an account on LDAP server using regular, for Web services, Sign-on workflow, i.e., in automatic manner. Would be useful to have instruments to prevent automated software from performing registration.		* Let people create an account on LDAP server using regular, for Web services, Sign-on workflow, i.e., in automatic manner. Would be useful to have instruments to prevent automated software from performing registration.
	* ~~Having~~ a "Forgot password" feature.		* Have a "Forgot password" feature.
	* ~~Editing~~ LDAP metadata.		* Edit LDAP metadata. Would be useful to let people authenticate on CAS, i.e., to avoid typing passwords twice, one time to get access to a service and the second one in Account management application before editing metadata.