Download Open_Id

By:
Ansuya Chauhan
What is Open ID???
• Single Sign-on System
• Simple to use
• Uses proven technologies like DNS,
HTTP,
• SSL/TLS and Diffie-Hellman
• It’s Decentralized
• It’s Free
History
•
•
•
•
2005
The original OpenID authentication protocol was developed in May
2005 by Brad Fitzpatrick, creator of popular community website LiveJournal,
while working at Six Apart.
2006
In March 2006, JanRain developed a Simple Registration Extension for
OpenID for primitive profile-exchange, and in April submitted a proposal to
formalize extensions to OpenID.
2007
On January 31, 2007, computer security company announced support
for OpenID in its Identity Initiative products and services.
2008
In mid-January 2008, Yahoo announced initial OpenID 2.0 support, both as
a provider and as a relying party, releasing the service by the end of the
month. In early February, Google, IBM, Microsoft, VeriSign, and Yahoo!
joined the OpenID Foundation as corporate board members.
Three Party System
Why OpenID?
•
•
•
•
•
Too many Usernames and Passwords
Someone took your desired Username
User profile is distributed
Account management is difficult
Get bored of filling long forms again and
again
With OpenId, you get to choose who
manages your identity
An OpenId is a URL
• URL are Globally unique.
• OpenId allows proving ownership of an
URL
• People already have identity at URLS via
blogs, photos, Myspace and Facebook Etc
Communication Modes
Direct Communication
Indirect Communication
Modes of Communication
There are two basic methods or modes of
communication between the consumer and
the identity provider depending upon how
consumer is configured.
• Dumb Mode
• Smart Mode
How OpenID works??
How openId works?
•
•
•
•
Site Fetches the HTML of my openID
Finds “ openid.server”
Establishes a shared secret with the provider
Redirects my browser to the provider where I
authenticate and allow the openId login
• Provider redirects my browser back to the site
with an openId response.
• Site verifies the signature and logs me in
How to Use OpenId?
• http://www.youtube.com/watch?v=Vq0R1Y1A2rE
Types of Messages
• Four basic types of messages
• The associate message
• The check_immediate message
• The check_setup message
The check_authentication message
Protocols and Security
• Authentication
Uses URL as the Identity of User
• OpenID 2.0 uses Yadis.
• Uses Diffie-Hellman Key Exchange Mechanism
at different level.
• Use Secured Socket Layer
• Generate strong MAC keys.
OpenID Support in different
Languages
• OpenID Is supported in many
programming languages and API’s are
available
• Java, PHP, Perl C/C++, C##, python ,cold
Fusion
Limitation of OpenID & Possible
Solutions.
• Phishing
• A distrusted site redirects you to your
trusted provider through a proxy.
Possible Solutions
• Trusted and Security features by OpenID provider
• Jabber
• Microsoft card space
• DynDNS
Advantages
• Globally unique & your URL is your Identity
• Few usernames and passwords to remember
• Many OpenID provider like AOL,
yahoo,verisignlabs, myOpenID
• Can put OpenID URL on your server also
• Profile data are stored at one place only.
• Control of sharing information.
• Can easily increase business
Future & Conclusion
• Future
• Email as OpenID
• Banking and E-commerce with strong
authentication
• Zero sign on
• High level security algorithm
Conclusion
OpenID as future web authentication
References
•
•
•
•
•
http://en.wikipedia.org/wiki/OpenID#History
http://www.livejournal.com/openid/
http://openid.net/
http://wiki.openid.net/OpenID_HTTP_Authentication
http://openidtrustbearer.wordpress.com/
• http://video.google.com/videoplay?docid=2288395847791059857