Superpatterns

Pat Patterson on Identity Management, Federation and Single Malt Scotch

accessmanager adoption authentication bloggers burtongroup catalyst community extensions federation google identity libertyalliance lightbulb links opends openid opensource opensso php saml sdn security sso sun webservices

12 Dec · Fri 2008

OpenSSO Tab Sweep - Dec 12 2008
[ .net aca atlanta awsome biometric fedlet glassfish markmail opensso pki salesforce saml sdn sharepoint telenet ]

It's been a while since the last tab sweep - lots of news since then, such as the OpenSSO Enterprise 8.0 release, that's kept me busy both here on the blog and 'in real life' (if there is such a thing any more!). Anyway, here are some of the titbits I've been saving for a tab sweep blog post:

I posted another OpenSSO adoption story to the Stories blog this morning: ACA IT-Solutions deploys OpenSSO at Telenet for fine-grained access control. You might remember I blogged about Telenet a little while ago, well, when we started covering OpenSSO on the Stories blog, Serge Craeghs of ACA IT-Solutions kindly completed the questionnaire for the Telenet deployment, with all sorts of juicy details - read all about it.
Another nifty feature of MarkMail - project-based homepages. Just go to http://opensso.markmail.org/ and you can search and browse just the OpenSSO mailing lists. Very cool!
Bert van Beeck writes about using SAML 1.x or SAML 2.0 to authenticate SharePoint users, with OpenSSO acting as a bridge between the Belgian Federal Authentication Service - FAS (a SAML 1.1 identity provider) and Microsoft SharePoint (which can speak WS-Federation, but not plain SAML 1.1).
On The Open Road, David Goldsmith explains how to work around issues in GlassFish V3 Prelude's cookie handling to allow OpenSSO to work correctly, with a nod to Dennis' diagnosis of the problem.
Although the Fedlet has been available for Java EE platforms for some time now, it's always been our intention to support .Net also, so it's great to see Rajeev Angal putting together a .Net Fedlet prototype. Give it a try and let Rajeev know how it goes.
Rajeev strikes again, alongside Marina Sum, with a Sun Developer Network article on Federated Single Sign-On for Salesforce in OpenSSO. It's amazing how easy these integrations are now that SAML has become so widespread. There might just be something to these 'standards' we keep hearing about
Over at Core Security Patterns, Ramesh Nagappan tantalizes us with a glimpse of a solution composed of Match-to-SmartCard PKI and Biometric authentication - starring OpenSSO in "multi-factor authentication based Web SSO that uses on-card credentials (PIN + PKI + Biometrics) using PIV card." More details, please, Ramesh!
Finally, John Willis' CloudDroplets #20 podcast covers the 'OpenSSO in the Clouds' presentation I gave this week at the AWSome Atlanta Meetup. Thanks again for the invitation to speak, John, I had a blast!

Well - that wraps things up for this week. Don't forget to vote for OpenSSO in the SOA World Readers' Choice Awards!!!

@ 04:09 PM PST

04 Sep · Thu 2008

OpenSSO Authentication Modules - Hitachi Finger Vein Biometric, Verisign Identity Protection, RSA Access Manager
[ biometric extensions hitachi opensso rsa verisign vip ]

I've blogged before on OpenSSO Extensions - useful modules that do not fit into the OpenSSO 'core'. Among the various categories of extension are 'authentication modules' - one of the most common customizations for OpenSSO and Access Manager. An authentication module supports a particular mechanism for collecting and verifying a user's credentials - common mechanisms that are supported out-of-the-box include username/password against LDAP, client certificates (encompassing browser certs and smartcards) and Windows Desktop SSO (aka SPNEGO, aka Kerberos).

Of course, technology refuses to stand still, and new authentication mechanisms are constantly being developed and deployed - new biometrics, hardware tokens, even whole new authentication protocols. Over the past few months, we've seen a clutch of new authentication modules in OpenSSO, so it's time to take a look at what's new...

The Hitachi Finger Vein Biometric module (README), developed by Yasushi Iwakata, interfaces with a infra-red based reader to use the unique patterns of veins in each user's finger as a credential. Yasushi recently left Sun, but continues as an external contributor to OpenSSO.
Jeff Bounds blogged about his Verisign Identity Protection module back in June. Since that blog entry, Jeff has uploaded the source as an OpenSSO Extension, so it's available to all; the README and Jeff's blog entry have everything you need to get started.
Strictly speaking, Wajih Ahmed's RSA Access Manager authentication module is located in the 'core' OpenSSO area, but it's an authentication module just the same. It allows you to integrate OpenSSO (or, of course, Access Manager) with, uh, RSA Access Manager (formerly known as ClearTrust) for co-existence, either permanently or as an initial phase in a migration. Again, there's a README to get you started.