who owns your virtual identity

Just read this article:

http://yro.slashdot.org/story/11/05/10/0039249/Who-Owns-Your-Social-Identity?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29&utm_content=My+Yahoo


Technically speaking we could have an identity provider that provides our identity as a service to different services like google, yahoo, ... even to our University , or why not, to our bank... Well there is already openid, but also other technologies like shibboleth, opensso, ....

So the problem is not really technical, but more "ethical". Who should be the provider? Governments? I do not think so.... maybe we should do the same as we do with internet domains, maybe...

just a random thought

Shibboleth identity provider

We (at openTrends) recently finished a project about installing an identity provider (IDP) based on shibboleth. It was not an easy one but we succeeded!

The most difficult part was managing all the configuration files. Certificates are stored in multiple files and that makes it difficult to configure and maintain.

We connected that identity provider to a CAS (Central Authentication System) that the organization already had installed and then to different Service Providers, that is, web applications that we wanted to get access to:

• google apps
• metalib

 Thought shibboleth looks complicated, it is being used specially in US. Alternatives are simpleSAMLphp and openSSO, both SAML compliance.

Installing and maintaing an Identity provider is not an easy task. It needs to be monitorized, upgraded, in cluster, ... and is a very important piece of the infraestructure. That is why Identity as a Service (IDaaS) can be a very good solution.