Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

Re: Single Sign-On?

by jhourcle (Prior)
on Mar 06, 2005 at 14:00 UTC ( [id://437038]=note: print w/replies, xml ) Need Help??


in reply to Single Sign-On?

As someone's who's had to deal with the 'single sign-on' concept before, I can mention a few of the bigger items that I've run into.

  1. Change -- each site has a current system that works, and takes negligible effort to maintain. You are asking each site to modify their authentication system, which has the possibility of breaking their site.
  2. Scalabilitiy issues -- You can either set up one large centralized authentication system (LDAP, Kerberos, whatever), or set up some way for each site to authenticate off of the other sites. So it's either a single point of failure, or n(n-1) complexity (and becomes more complex as new sites are added).
  3. Incompatable user names -- my PAUSE id is 'ONEIROS'. My perl.org id is 'oneiros', and my id on here is 'jhourcle'. You would have to add complexity to deal with the fact that names may not map from system to system, and that the same id may be used by two different people across the systems. Trying to unify the systems after the fact is a massive PITA -- you can have each person create a new unified account, and then map all of their existing accounts back to it, but you get bickering when someone takes a userid that's been long associated with someone else (even if only one one system).
  4. Account management -- You need a way for sites to request password changes, or information changes, or to recover lost passwords, or whatever might be needed. Which leads us to...
  5. Trust -- and this is the biggest one -- certified logins only work when everyone trusts each other -- no one's going to authenticate as the wrong person, or otherwise claim to be someone else. They're not going to cache a password so that they can use it to gain access they might not have otherwise had. (AdminA on SiteA logs into SiteB. AdminB steals AdminA's credentials, so they can get admin access on SiteA; Or HackerC gets into SiteB, and then uses that to gain abnormal privs on SiteA and the rest of the network)

I'm not going to pretend that there aren't advantages to the users for single sign-on, but it is a royal pain to administer, especially if you're attempting to retrofit it into systems that already have active accounts.

Yes, it's possible, but there's a good chance that the risks and headaches that it would entail aren't worth it to the various site admins -- especially as it might be something that they aren't familiar with, and so it'd be a complete unknown risk.

If this is going to happen, I would assume it would start small, either centralized around one person who can unify the various sites, who is well trusted, and would take responsibility for the whole thing; or two sites who trust each other would band together, and possibly later add other sites into their circle of trust. I definately don't think this is as easy as someone saying 'make it so', and it happening overnight.

Replies are listed 'Best First'.
Re^2: Single Sign-On?
by Thilosophy (Curate) on Mar 07, 2005 at 02:47 UTC
    Change -- each site has a current system that works, and takes negligible effort to maintain.

    I agree that is a main issue. Especially since there seems to be no simple (yet good) implementation of Single-Sign-On systems.

    Scalabilitiy issues

    I'd say distributed systems scale better. And from the view-point of any given site, it is only a 1:n relationship, and ideally would all use the the protocol, so that authenticating from different sites would not be a more complex task than sending emails to different domains (Email is also an n:n system that works....)

    Incompatable user names

    Yeah, you would need some map. But mapping your userid to your password (and probably email address) as is happening now, does not seem easier than mapping your (local) userid to the remote userid.

    Account management

    This could actually get a lot easier than it is now. The participating web sites do not need any password management system at all (since this is handled by the few identity providers). They just need to decide what sites to federate with. And for the user there is only a single place he has to go to manage his password (Actually, it does not have to be password-based at all, more complex systems like client-side SSL authentication that are just to difficult for small web sites to set up could be handled efficiently and transparently)

    Trust -- and this is the biggest one -- certified logins only work when everyone trusts each other

    This is the second main point. But if I wanted to start a Perl community site, where I just need to assign nicknames to people, without intent to gather email addresses, no online payment or such involved, I would probably trust the PerlMonks enough to let them handle my login.

    Also note that a password is never given to any site other than the user's identity provider. The web site he logs in to never sees it.

Re^2: Single Sign-On?
by Xenograg (Scribe) on Mar 11, 2005 at 22:04 UTC
    ++jhourcle and ++Thilosophy

    I am currently in a group developing a community of role-play web sites. Usernames here are not just nicknames but characters played. An ideal system would utilize Single Sign-on to maintain each character identity through the various "worlds" (sites).

    Having said that, your points #2, #4, and #5 are spot-on. No one is getting paid for this work on our hobby, let alone it being their job. When (not if) the SSO has a problem, the entire community will be down until someone (me?) gets home at night.

    --- The harder I work, the luckier I get.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://437038]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others goofing around in the Monastery: (4)
As of 2024-03-29 14:28 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found