By Ken Klingenstein
(Note: This is the first in a series of blog posts highlighting key sessions at this year’s Technology Exchange (TechEx), December 9-13, 2019, in New Orleans).
In the last few years, proxies and portals have become a common way for communities to integrate access to their diverse networked resources as a cohesive environment, leveraging modern authentication and authorization technologies. A researcher can use a single federated identity and a mix of institutional and collaboration-specific attributes to control instruments, access data sets, tap into national computing resources, interact with scholarly publishers, and maintain their CV. Behind this elegant facade, however, can lie a tangle of issues and challenges.
While portals can vary greatly in the functionalities they provide, most use a federated identity to access the site and gather a few institutional attributes in the process. Many then provide the ability for the community to mint groups and attributes specific to the collaboration. Usually there is some credential conversion capability, frequently allowing federated SAML logins to access OAuth-based applications. Other features could include simplifying participation by applications in a multilateral world by providing a single virtual IdP, acting as a hub for a hub-and-spoke federation, and providing value-added services, such as managed attribute release and consent.
With all these capabilities comes complexities and problems. For example, by their very intent, portals shield users from the intricacies behind the curtain but introduce a middleman that has to broker issues, such as incident handling and managing privacy. The middleman becomes part of a trust fabric that wasn’t engineered for such features in the landscape. For example, the portal may be asserting attributes for which it is not authoritative; it may have incident handling responsibilities that need to work with the IdP and Relying Party. The proxy presents significant privacy vulnerabilities by seeing and facilitating interactions that are presumed by the end-parties to be protected. There are other operational challenges as well, from working with individual relying parties with custom needs, e.g. compliance rules, to addressing the costs of the proxy service.
Given the importance of proxies, and the nature of the challenges they present for trust and identity, it is very timely to have an extended cross-cutting session at TechEx that presents and explores how we might address the issues. This session will bring together international thought leaders in the art of proxies to discuss the communities they serve, the benefits they provide, and the challenges they face. Perspectives include campus IT, federated operators, proxy providers, and relying parties.
We’ll begin with each of them describing their communities served, the services and the benefits they provide, and the challenges they face. Then, we’ll move into a group discussion to more deeply probe the problems and how they might be addressed. We’ll look at issues of trust and privacy, shareability, working with relying parties, examining the impacts of applications choosing to sit behind a proxy, cost, and how we might add proxy as a distinct type in the federation model.