OAuth2 – The Passwordless World of Mobile

Keeping in vogue with the fashion of killing off certain standards, technology or trends, I think it's an easy one to say, that the life of the desktop PC (and maybe even the laptop...) is coming to an end.
Smartphone sales are in the hundreds of millions per quarter and each iteration of both the iOS and Android operating system brag of richer user experiences and more sophisticated storage and app integration.  The omnipresent nature of these powerful mini-computers, has many profound benefits, uses and user benefits.



Mobile Weakness + Password Weakness = Nightmare!

With anything in the information world that is popular, comes with it security weaknesses and vulnerabilities.  The popularity aspect is a big trigger for the generation of malware and criminal intent.  As a malware developer, you would want the reward ration to be as high as possible, which means developing exploits for devices and operating systems that are the most popular.  Some key aspects of all mobile devices however result in general security weakness.  Firstly, they're small, meaning they can be easily lost or stolen.  That weakness is pretty difficult to overcome.  Unfortunately as mobiles now hold significant personal and professional information, emails, attachments, cached passwords and so on, a physical loss can have significant impact.  Most mobile devices carry no real form of anti-virus or anti-malware software, albeit this is improving.

Passwords as we know, are now not regarded as a secure means to protect websites and applications.  End users don't tend to select complex passwords (if they do they are written down...) and the transport and storage of such passwords (lack of encrypted channels, passwords not hashed in storage) all contribute to more instances of password leaks and compromise.

Password use on mobile phones, then introduces a mixture of potential vulnerabilities.  Mobile users want to access protected applications, social networking sites and web sites, all with email address and password based authentication.

Mobile keyboards are small, so many will simply enter the credentials once and cache them, leaving them vulnerable to reuse and capture if the device is lost or the operating system compromised.


Introduce OAuth2

OAuth2 (not to be confused with OAuth or OATH...) is making great strides in being the defacto standard authorization protocol, for web applications and modern federated services.  OAuth2 provides a neat access and refresh token approach to giving access to sites and services, which can reduce the burden of using static username and password based authentication and authorisation.  At a high level, OAuth2, can issue both an access token and refresh token, along with what is known as a scope.

The access token does what it says, and generally has a small lifespan - perhaps only a few minutes. The refresh token on the other hand, may have a longer lifespan and can be exchanged for a new access token in the future, without the need to re-enter usernames or passwords.  The benefit being, that the OAuth2 authorization server, can revoke the refresh token if the device that holds it, is compromised or lost. A significant improvement on having to reset passwords if a mobile is lost and contains cached passwords.  The scope aspect is simply a list of permission attributes that the authorisation server attaches to the associated access token before releasing to the requesting resource.

OAuth2 provides several different mechanisms for releasing tokens (called grants) which I wont go into here, but ultimately there is less reliance on the repeated entry of usernames and passwords.  The use of tokens removes the need for the caching of such credentials and also does not require credential exchange between the authorisation service and the protected resource.

By being able to remotely revoke an access or refresh token, gives the identity owner much more control in the event that a physical device is lost, stolen or compromised.

In addition, as passwords would be required less, more complex passwords can be used (created using generators) in order to provide a little more protection.

By Simon Moffatt





OAuth2 – The Passwordless World of Mobile

Keeping in vogue with the fashion of killing off certain standards, technology or trends, I think it's an easy one to say, that the life of the desktop PC (and maybe even the laptop...) is coming to an end.
Smartphone sales are in the hundreds of millions per quarter and each iteration of both the iOS and Android operating system brag of richer user experiences and more sophisticated storage and app integration.  The omnipresent nature of these powerful mini-computers, has many profound benefits, uses and user benefits.



Mobile Weakness + Password Weakness = Nightmare!

With anything in the information world that is popular, comes with it security weaknesses and vulnerabilities.  The popularity aspect is a big trigger for the generation of malware and criminal intent.  As a malware developer, you would want the reward ration to be as high as possible, which means developing exploits for devices and operating systems that are the most popular.  Some key aspects of all mobile devices however result in general security weakness.  Firstly, they're small, meaning they can be easily lost or stolen.  That weakness is pretty difficult to overcome.  Unfortunately as mobiles now hold significant personal and professional information, emails, attachments, cached passwords and so on, a physical loss can have significant impact.  Most mobile devices carry no real form of anti-virus or anti-malware software, albeit this is improving.

Passwords as we know, are now not regarded as a secure means to protect websites and applications.  End users don't tend to select complex passwords (if they do they are written down...) and the transport and storage of such passwords (lack of encrypted channels, passwords not hashed in storage) all contribute to more instances of password leaks and compromise.

Password use on mobile phones, then introduces a mixture of potential vulnerabilities.  Mobile users want to access protected applications, social networking sites and web sites, all with email address and password based authentication.

Mobile keyboards are small, so many will simply enter the credentials once and cache them, leaving them vulnerable to reuse and capture if the device is lost or the operating system compromised.


Introduce OAuth2

OAuth2 (not to be confused with OAuth or OATH...) is making great strides in being the defacto standard authorization protocol, for web applications and modern federated services.  OAuth2 provides a neat access and refresh token approach to giving access to sites and services, which can reduce the burden of using static username and password based authentication and authorisation.  At a high level, OAuth2, can issue both an access token and refresh token, along with what is known as a scope.

The access token does what it says, and generally has a small lifespan - perhaps only a few minutes. The refresh token on the other hand, may have a longer lifespan and can be exchanged for a new access token in the future, without the need to re-enter usernames or passwords.  The benefit being, that the OAuth2 authorization server, can revoke the refresh token if the device that holds it, is compromised or lost. A significant improvement on having to reset passwords if a mobile is lost and contains cached passwords.  The scope aspect is simply a list of permission attributes that the authorisation server attaches to the associated access token before releasing to the requesting resource.

OAuth2 provides several different mechanisms for releasing tokens (called grants) which I wont go into here, but ultimately there is less reliance on the repeated entry of usernames and passwords.  The use of tokens removes the need for the caching of such credentials and also does not require credential exchange between the authorisation service and the protected resource.

By being able to remotely revoke an access or refresh token, gives the identity owner much more control in the event that a physical device is lost, stolen or compromised.

In addition, as passwords would be required less, more complex passwords can be used (created using generators) in order to provide a little more protection.

By Simon Moffatt





LDAPCon 2013 – a summary…

ldapcon_2013_logo_line_dateLast Monday and Tuesday (Nov 18-19), I was in Paris attending the 4th International LDAP Conference, an event I help to organize with LDAPGTF, a network of French actors in the LDAP and Identity space. ForgeRock was also one of the 3 gold sponsors of the conference along with Symas and Linagora.

LDAPCon 2013The conference happens every other year and is usually organized by volunteers from the community. This year, the French guys were the most motivated, especially Clément Oudot from Linagora, leader of the LDAP Tool Box and lemonLDAP projects, and Emmanuel Lecharny one of the most active developers on Apache Directory Server.

I was honored to be the keynote and first speaker of the conference and presented “The Shift to Identity Relationship Management“, which was well received and raised a lot of interest from the audience.

The first day was focusing more on the users of LDAP and directory services technologies, and several presentations were made about REST interfaces to directory services, including the standard in progress: SCIM.

Kirian Ayyagari, from the Apache Directory project, presented his work on SCIM and the eSCIMo project. Present for the first time at LDAPCon, Microsoft’s  Philippe Beraud spoke about Windows Azure Active Directory and its Graph API. And I talked about and demoed the REST to LDAP service that we’ve built in OpenDJ. For the demo, I used PostMan, a test client for HTTP and APIs, but also our newly open sourced sample application for Android : OpenDJ contact manager. In the afternoon, Peter Gietz talked about the work he did around SPML and SCIM leveraging OpenLDAP access log.

After many talks about REST, we had a series of talk around RBAC. Shawn McKinney presented the Fortress open source IAM project and more specifically the new work being done around RBAC. Then Peter, Shawn and Markus Widmer talked about the effort to build a common LDAP schema for RBAC. And Matthew Hardin talked about the OpenLDAP RBAC overlay bringing policy decisions within the directory  when deploying Fortress.

Then followed presentations about local directory proxy services for security based on OpenLDAP, about Red Hat FreeIPA (another first appearance at LDAPCon) and about OpenLDAP configuration management with Apache Directory Studio. Also Stefan Fabel came all the way from Hawaii ( Aloha ! ) to present a directory based application for managing and reporting publications by a university: an interesting story about building directory schema and data model.

The day ended with a presentation from Clement Oudot about OpenLDAP and the password policy overlay. As usual, talking about the LDAP password policy internet-draft raises the question of when it will be finally published as an RFC. While there is a consensus that it’s important to have a standard reference document for it, I’m failing to see how we can dedicate resources to achieve that goal. Let’s see if someone will stand up and take the leadership on that project.

After such a long day of talks and discussion, most of the attendees converged to a nearby pub where we enjoyed beers and food while winding down the day through endless discussions.

The second day of LDAPCon 2013 was more focused on developers and the development of directory services. It was a mix of status and presentations of open source directory projects like OpenDJ, OpenLDAP or LSC, some discussions about backend services, performance design considerations and benchmarks, a talk about Spring LDAP… As usual, we had a little bit of a musical introduction to Howard Chu‘s presentation.

LP0_1068I enjoyed the Benchmark presentation by Jillian Kozyra, which was lively, rational and outlining the major difference between open source based products and closed source ones (although all closed source products were anonymized due to license restrictions). It’s worth noting that Jillian is pretty new in the directory space and she seems to have tried to be as fair as possible with her tests, but she did say that the best documented product and the easiest one to install and deploy is OpenDJ. Yeah !!! :-)

Another interesting talk was Christian Hollstein‘s about his “Distributed Virtual Transaction Directory Server“, a telco grade project he’s working on to serve the needs of the 4G network services (such as HSS, HLR…). It’s clear to me that telco operators and network equipment providers are now all converging to LDAP technologies for the network and this drives a lot of requirements on the products (something I knew since we started the OpenDS project at Sun, kept in mind while developing OpenDJ, even though right now our focus has mainly been on the large enterprises and consumer facing directory services).

All the slides of the conference have been made available online through the LDAPCon.org website and the Lanyrd event page. Audio has also been recorded and will be made available once processed. And as usual, all the photos that I took during the conference are publicly available in my Flickr LDAPCon 2013 Set. Feel free to copy for personal use.

It’s been a great edition of the LDAPCon and I’m looking forward to the next one, in 2 years !

Meanwhile I’d like to thanks the sponsors, all 75 attendees, the 19th speakers and the 2 organizers I had not mentioned yet : M.C. Jonathan Clarke and Benoit Mortier.


Filed under: Directory Services Tagged: conference, directory, directory-server, ForgeRock, france, identity, ldap, ldapcon, opendj, Paris, photography

A Sample OpenIG configuration showing Tomcat Login



ForgeRock's  Open Identity Gateway (OpenIG) is a "smart" reverse proxy interacts with the HTTP session to modify headers, cookies, and the body.

A common OpenIG  use case is to SSO enable legacy applications that can not be modified to use a policy agent.

The way this works is described in the gateway guide but the readers digest version is:
  • OpenIG itself is protected with an OpenAM policy agent
  • OpenAM's password capture post authentication handler is configured to capture the user's password on login, and provide it (encrypted) to OpenIG. 
  • OpenIG is configured to watch for an HTTP request to the legacy application's login page
  • When OpenIG sees the login page it injects the users credentials into the login flow. 
The guide has a few examples for Wordpress login - but I wanted to demonstrate login to Tomcat. 

This OpenIG config.json file is configured to SSO into the sample form login demo that included with tomcat (/examples/jsp/security/protected).

This config.json assumes:

  • A tomcat instance is running on port 48080 with the sample application. This is our "legacy" application.
  • tomat-users.xml has the sample user and password configured. The user must also have the roles "role1" and "tomcat" (this is the way the tomcat demo works - nothing to do with OpenIG...)
  • Before using the gateway make sure you can login directly to the sample application without going through the gateway (for this example: try logging in to http://openam.example.com:48080/examples/jsp/security/protected/)
  • OpenIG is running on another tomcat instance on port 28080 
  • You have followed the OpenIG guide to integrate OpenAM and OpenIG, and enable the password capture post auth handler. 

You now should be able to go to 

http://openam.example.com:28080/examples/jsp/security/protected/login.jsp 

If all is well you will be redirected to OpenAM. Once you have authenticated, the gateway will inject your credentials into the flow and log you in to the sample application.








The Road To Identity Relationship Management

The Problems With Identity & Access Management

I am never a fan of being the bearer of dramatic bad news - "this industry is dead!", "that standard is dead!", "why are you doing it that way, that is so 2001!".  Processes, industries and technologies appear, evolve and sometimes disappear at their own natural flow.  If a particular problem and the numerous solutions are under discussion, it probably means at some point, those solutions seemed viable.  Hindsight is a wonderful thing.  With respect to identity and access management, I have seen the area evolve quite rapidly in the last 10 years, pretty much the same way as the database market, the antivirus market, the business intelligence market, the GRC market and so on.  They have all changed.  Whether for the better or worse, is open for discussion, but in my opinion that is an irrelevant discussion, as that is the market which exists today.  You either respond to it, or remove yourself from it.



Like most middleware based sectors, identity and access management has become a complex, highly optimized monster.  Tools on top of tools, to help you get the most out of tools you purchased long ago and sit at the bottom of the stack.  Projects are long and complex.  Milestones blurred.  Stakeholders come from different spectrums of the organisation, with differing goals and drivers.  Vendors have consolidated and glued together complex suites of legacy solutions, built on different frameworks and with different goals in mind.  The end result?  A confused customer and a raft of splinter point products that claim to offer speed and cost improvements to existing 'legacy' solutions.


The Modern Enterprise

I blogged recently about the so called 'modern' enterprise, and how it has evolved to include facets from the mobile, social and outsourced worlds.  Organisations have faced tremendous issues since 2008 when it comes to profitability, with shrinking markets, lower revenues and more stringent internal cost savings.  All of which, have placed pressure on identifying new and more effective revenue streams, either from developing new products faster, or by extracting more revenue from existing customers, by leveraging company brand and building better, more online focused relationships.  All of these avenues of change, rely heavily on identity management.  Firstly, by allowing things like online client registration to occur rapidly and seamlessly, right through to allowing new approaches such as mobile and cloud to be integrated into a single revenue focused platform.

The long and winding identity road - image taken by Simon Moffatt, New South Wales, AU. 2011
Gone are the days when identity management was simply focused on managing employee access to the corporate directory and email server.  Organisations are now borderless, with a continually connected workforce.  That workforce is also not simply focused on employees either.  The modern enterprise workforce, will contain contractors, freelancer and even consumers themselves.  Bloggers, reviewers, supporters, promoters, content sharers and affiliates, whilst not on the company payroll, help drive revenue through messaging and interaction.  If a platform exists where their identity can be harnessed, a new more agile go to market approach can be developed.


Scale, Agility and Engagement

But what does this all mean practically?  New widgets, more sprockets and full steam ahead on the agitator!  Well not quite.  It does require a new approach.  Not a revolution but evolution.  Modernity in all levels, seems to mean big.  Big data.  Big pipes.  Big data centres.  Scale is a fundamental component of modern identity.  Scale, too can come in many different flavours.  Numbers yes.  Can you accommodate a million client registrations?  What about the process, flows and user interfaces that will be needed to manage such scale?  Modularity is key here.  A rigid, prescribed system will result in a rigid and prescribed service.  Flexibility and a loosely decoupled approach will allow system and user interface integration in a much more reusable way.  Languages, frameworks and standards are now much less about vendor sponsorship and much more about usability and longevity.  Modern identity is really about improving engagement, not just at the individual level, but also at the object and device level.  Improved engagement will result in better relationships and ultimately more informed decision making.

Ultimately economics is based fundamentally on clear, fully informed decision making, and if a modern enterprise can develop a service to fully inform and engage its client base, new revenue opportunities will sharply follow.





The Road To Identity Relationship Management

The Problems With Identity & Access Management

I am never a fan of being the bearer of dramatic bad news - "this industry is dead!", "that standard is dead!", "why are you doing it that way, that is so 2001!".  Processes, industries and technologies appear, evolve and sometimes disappear at their own natural flow.  If a particular problem and the numerous solutions are under discussion, it probably means at some point, those solutions seemed viable.  Hindsight is a wonderful thing.  With respect to identity and access management, I have seen the area evolve quite rapidly in the last 10 years, pretty much the same way as the database market, the antivirus market, the business intelligence market, the GRC market and so on.  They have all changed.  Whether for the better or worse, is open for discussion, but in my opinion that is an irrelevant discussion, as that is the market which exists today.  You either respond to it, or remove yourself from it.



Like most middleware based sectors, identity and access management has become a complex, highly optimized monster.  Tools on top of tools, to help you get the most out of tools you purchased long ago and sit at the bottom of the stack.  Projects are long and complex.  Milestones blurred.  Stakeholders come from different spectrums of the organisation, with differing goals and drivers.  Vendors have consolidated and glued together complex suites of legacy solutions, built on different frameworks and with different goals in mind.  The end result?  A confused customer and a raft of splinter point products that claim to offer speed and cost improvements to existing 'legacy' solutions.


The Modern Enterprise

I blogged recently about the so called 'modern' enterprise, and how it has evolved to include facets from the mobile, social and outsourced worlds.  Organisations have faced tremendous issues since 2008 when it comes to profitability, with shrinking markets, lower revenues and more stringent internal cost savings.  All of which, have placed pressure on identifying new and more effective revenue streams, either from developing new products faster, or by extracting more revenue from existing customers, by leveraging company brand and building better, more online focused relationships.  All of these avenues of change, rely heavily on identity management.  Firstly, by allowing things like online client registration to occur rapidly and seamlessly, right through to allowing new approaches such as mobile and cloud to be integrated into a single revenue focused platform.

The long and winding identity road - image taken by Simon Moffatt, New South Wales, AU. 2011
Gone are the days when identity management was simply focused on managing employee access to the corporate directory and email server.  Organisations are now borderless, with a continually connected workforce.  That workforce is also not simply focused on employees either.  The modern enterprise workforce, will contain contractors, freelancer and even consumers themselves.  Bloggers, reviewers, supporters, promoters, content sharers and affiliates, whilst not on the company payroll, help drive revenue through messaging and interaction.  If a platform exists where their identity can be harnessed, a new more agile go to market approach can be developed.


Scale, Agility and Engagement

But what does this all mean practically?  New widgets, more sprockets and full steam ahead on the agitator!  Well not quite.  It does require a new approach.  Not a revolution but evolution.  Modernity in all levels, seems to mean big.  Big data.  Big pipes.  Big data centres.  Scale is a fundamental component of modern identity.  Scale, too can come in many different flavours.  Numbers yes.  Can you accommodate a million client registrations?  What about the process, flows and user interfaces that will be needed to manage such scale?  Modularity is key here.  A rigid, prescribed system will result in a rigid and prescribed service.  Flexibility and a loosely decoupled approach will allow system and user interface integration in a much more reusable way.  Languages, frameworks and standards are now much less about vendor sponsorship and much more about usability and longevity.  Modern identity is really about improving engagement, not just at the individual level, but also at the object and device level.  Improved engagement will result in better relationships and ultimately more informed decision making.

Ultimately economics is based fundamentally on clear, fully informed decision making, and if a modern enterprise can develop a service to fully inform and engage its client base, new revenue opportunities will sharply follow.





Updates to opendj-utils

About a year ago, I’ve introduced a set of OpenDJ scripts and utilities that I’ve built to facilitate my work with OpenDJ.

Last week, I’ve pushed some updates to the github repository.

The first improvements are in logstat.py. I’ve added support for collecting stats about the Abandon operation, as well as some counting and reports on the errors to each operation. This allows to get a feel of how many operations failed and the error code reported.

The second update is a new utility names filterstat.py which scans through access log files and builds a sorted list of all filters used in search requests. The filters are generalized and collated together, and the result should help administrators to understand which attributes should be indexed and what kind of index are required.

Here’s a sample output of filterstat (based on an instance of OpenDJ used by OpenAM). The first value is the count and the string is the generic representation of the filter:

$ ~/opendj-utils/filterstat.py access
processing file: access
213783 (&(uid=VALUE)(objectclass=VALUE))
2080 (&(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE))(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE))(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)))
807 (&(objectclass=VALUE)(uniqueMember=VALUE))
244 (&(cn=VALUE)(objectclass=VALUE))
213 (&(&(uid=VALUE)(objectclass=VALUE)))
140 (&(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE))(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE))(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)))
63 (&(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE))(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE))(|(sunxmlKeyValue=VALUE)(sunxmlKeyValue=VALUE)))
39 (&(&(cn=VALUE)(objectclass=VALUE)))
6 (&(uid=*SUBSTRING*)(objectclass=VALUE))
2 (&(objectclass=VALUE)(ou=VALUE))
1 (&(&(uid=*)(objectclass=VALUE))(|(uid=VALUE)))
Base search filters only:
2487 (|(objectclass=*)(objectclass=VALUE))
Done

Please give those tools a try and let me know how useful they are for you. And if you have ideas on how to improve them, feel free to fork them and contribute.


Filed under: Directory Services Tagged: directory, directory-server, ForgeRock, github, java, opendj, opensource, utilities

What a great ForgeRock European Open Identity Summit !

Chateau BehoustLast week, ForgeRock hosted its first european Open Identity Summit, in the “Chateau de Béhoust” just outside Paris. For two and half days, our 110+ visitors, a mix of customers, prospect customers, partners and consultants, could attend presentations, meet and greet with ForgeRock employees, have lengthy discussions with peers, exchanging experience or use case scenarios around the ForgeRock Open Identity Stack. All of this in a very relaxed and friendly atmosphere.

All of the presentations have been filmed and will be available shortly through our web site and the summit page. If you missed the event and want to get a feel of the content, please check Simon Moffat’s review.

As usual, I’ve taken a few pictures of the event.

Thanks to all attendees and sponsors of the event. And see you next year for the second edition of our ForgeRock summits.

LP0_0488LP0_0538LP0_0595


Filed under: General Tagged: conference, ForgeRock, france, identity, ois13, Open, openam, opendj, OpenIdentityStack, openidm, Paris, summit

European Open Identity Summit – Review

This week saw the first European Open Identity Summit hosted by identity management vendor ForgeRock [1].  Following hot on the heels of the US summit, that was in Pacific Grove, California in June, the sold out European event, brought together customers, partners, vendors and analysts from the likes of Salesforce, Deloitte, Forrester and Kuppinger Cole amongst others.

Whilst the weather was typically October-esque, the venue was typically French chateau, set in panoramic grounds, with great hosting, food and wine to keep everyone in a relaxed mood.

The agenda brought together the key themes of the modern identity era, such as standards adoption (XACML, SAML2, OAuth2, OpenID Connect, SCIM), modern implementation approaches (JSON, API, REST) through to the vision for modern identity enablement for areas such as mobile and adaptive authentication, all whilst allowing customers and partners a chance to collaborate and swap war stories with some great networking.


Consumer Identity As A Revenue Generator

I have discussed the evolution of identity management on several occasions over the years (not least in August!), with the current iteration seeing a strong focus on utilising the identity of the consumer, as an approach to help drive new and existing revenue, for services and applications.  By capturing consumer identity details, either via portal facing registration systems, or making services available online, brand stickiness can be increased and a more relationship based approach can be developed. Developing platforms for consumer focused identity, requires several key components, mainly scale, modularity and agility.


Salesforce Expand Identity Offering

One of the key announcements at the summit was the expansion of the identity offering, by CRM software as a service giants, Salesforce.  With the Identity Connect platform, Salesforce and ForgeRock have entered into an OEM agreement, where the ForgeRock Open Identity Stack is used to enable the Salesforce solution to allow enterprises to seamlessly integrate with existing on-premise identity directories, with additional SSO capabilities.  Salesforce hope the solution will accelerate the onboarding of new and existing client accounts into their portfolio of online services. This is yet another example of organisations seeing customer identity as a key strategic component of business enablement and revenue generation.


Passwords Are Dead...Long Live The Password!

One of this years keynote speakers was Forrester's Eve Maler.  Always an articulate presenter, Eve dropped the bombshell that 'passwords are dead...'.  Whilst this isn't probably the most surprising announcement in the identity and infosec worlds, there is still to be defined, a clear way to replace the use of passwords as an authentication mechanism.  This is a topic I have blogged on multiple occasions (The Problem With Passwords Again, Still - Oct 2012, The Password Is Dead (Long Live The Password) - Feb 2012, Passwords And Why They're Going Nowhere - Mar 2013).  The failures of password use, storage and implementation are well known, but they are now too well embedded technically and psychologically, that a simple passage to something resembling biometric sustainability is somewhat remote.  Answers on a postcard with how that can be obtained!


The Future is Bright

Everyone loves modern - modern art, modern fashion, cutting edge music, the latest tech gadgets, but where does that leave modern identity management?  Modern in this respect, shouldn't just be focused on the new and shiny.  It needs to be focused on the new and useful.  Mobile devices are clearly the key component for information access, either via smart phones or tablets.  The desktop is dead and the laptop not far behind.  Modern identity needs to integrate seamlessly with mobile devices, utilising native technologies and loosely coupled REST based APIs and integration points.  Modern identity must also be convenient and easy to use.  Security in general is bypassed when too restrictive or complex and modern identity is no different.  For authentication and authorization processes to be effective, they need to convenient, good looking and easy to use.


The summit was a great event, that produced some interesting and thought provoking discussions, highlighting identity management as a key component of many organisations' go-to-market approach for 2014 and beyond.


[1] - For audience transparency, the author is employed by ForgeRock.

European Open Identity Summit – Review

This week saw the first European Open Identity Summit hosted by identity management vendor ForgeRock [1].  Following hot on the heels of the US summit, that was in Pacific Grove, California in June, the sold out European event, brought together customers, partners, vendors and analysts from the likes of Salesforce, Deloitte, Forrester and Kuppinger Cole amongst others.

Whilst the weather was typically October-esque, the venue was typically French chateau, set in panoramic grounds, with great hosting, food and wine to keep everyone in a relaxed mood.

The agenda brought together the key themes of the modern identity era, such as standards adoption (XACML, SAML2, OAuth2, OpenID Connect, SCIM), modern implementation approaches (JSON, API, REST) through to the vision for modern identity enablement for areas such as mobile and adaptive authentication, all whilst allowing customers and partners a chance to collaborate and swap war stories with some great networking.


Consumer Identity As A Revenue Generator

I have discussed the evolution of identity management on several occasions over the years (not least in August!), with the current iteration seeing a strong focus on utilising the identity of the consumer, as an approach to help drive new and existing revenue, for services and applications.  By capturing consumer identity details, either via portal facing registration systems, or making services available online, brand stickiness can be increased and a more relationship based approach can be developed. Developing platforms for consumer focused identity, requires several key components, mainly scale, modularity and agility.


Salesforce Expand Identity Offering

One of the key announcements at the summit was the expansion of the identity offering, by CRM software as a service giants, Salesforce.  With the Identity Connect platform, Salesforce and ForgeRock have entered into an OEM agreement, where the ForgeRock Open Identity Stack is used to enable the Salesforce solution to allow enterprises to seamlessly integrate with existing on-premise identity directories, with additional SSO capabilities.  Salesforce hope the solution will accelerate the onboarding of new and existing client accounts into their portfolio of online services. This is yet another example of organisations seeing customer identity as a key strategic component of business enablement and revenue generation.


Passwords Are Dead...Long Live The Password!

One of this years keynote speakers was Forrester's Eve Maler.  Always an articulate presenter, Eve dropped the bombshell that 'passwords are dead...'.  Whilst this isn't probably the most surprising announcement in the identity and infosec worlds, there is still to be defined, a clear way to replace the use of passwords as an authentication mechanism.  This is a topic I have blogged on multiple occasions (The Problem With Passwords Again, Still - Oct 2012, The Password Is Dead (Long Live The Password) - Feb 2012, Passwords And Why They're Going Nowhere - Mar 2013).  The failures of password use, storage and implementation are well known, but they are now too well embedded technically and psychologically, that a simple passage to something resembling biometric sustainability is somewhat remote.  Answers on a postcard with how that can be obtained!


The Future is Bright

Everyone loves modern - modern art, modern fashion, cutting edge music, the latest tech gadgets, but where does that leave modern identity management?  Modern in this respect, shouldn't just be focused on the new and shiny.  It needs to be focused on the new and useful.  Mobile devices are clearly the key component for information access, either via smart phones or tablets.  The desktop is dead and the laptop not far behind.  Modern identity needs to integrate seamlessly with mobile devices, utilising native technologies and loosely coupled REST based APIs and integration points.  Modern identity must also be convenient and easy to use.  Security in general is bypassed when too restrictive or complex and modern identity is no different.  For authentication and authorization processes to be effective, they need to convenient, good looking and easy to use.


The summit was a great event, that produced some interesting and thought provoking discussions, highlighting identity management as a key component of many organisations' go-to-market approach for 2014 and beyond.


[1] - For audience transparency, the author is employed by ForgeRock.