% webauth-slides.tex -- Slides for WebAuth status and directions.
% $Id$
%
% Written by Russ Allbery <rra@stanford.edu>

\documentclass[landscape,semhelv]{seminar}
\usepackage{url}
\usepackage{hyperref}

\newpagestyle{mypagestyle}%
  {Stanford University \hfil \thedate \hfil \thepage}%
  {\hfil Russ Allbery (rra@stanford.edu) \hfil}
\pagestyle{mypagestyle}

\begin{document}

\begin{slide}
  \begin{center}
    {\large Stanford Web Authentication Overview}

    \vspace{1in}
    
    Russ Allbery \\
    June 6, 2006
  \end{center}
\end{slide}

\begin{slide}
  \section*{Contents}

  \begin{itemize}
  \item Stanford WebAuth Design Goals
  \item WebAuth Strengths
  \item WebAuth Weaknesses
  \item Future Direction
  \item HTTP Negotiate Introduction
  \item HTTP Negotiate Deployment Challenges
  \item Shibboleth
  \item Fitting It Together
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Stanford WebAuth Design Goals}

  \begin{itemize}
  \item No central state for simple scalability
  \item Use browser cookie jar as a credential store
  \item Support credential delegation
  \item Support backward compatibility
  \item Extensible protocol without authentication assumptions
  \item LDAP integration (with backward compatibility)
  \item No central server required after initial authentication
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{WebAuth Strengths}

  \begin{itemize}
  \item Very widespread deployment at Stanford
  \item Well-tested and stable in production
  \item Extensible protocol based strongly on Kerberos
  \item Extensive documentation
  \item Strong LDAP integration
  \item Easily scalable, good support for load-balanced pools
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{WebAuth Weaknesses}

  \begin{itemize}
  \item Protocol inherently incapable of doing central logout
  \item No official Windows IIS support
  \item Not as widely used, so smaller development community
  \item Complex protocol
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Future Direction}

  \begin{itemize}
  \item HTTP Negotiate for initial sign-on
  \item Cannot replace WebAuth, Cosign looks great, can we merge?
    \begin{itemize}
    \item Support Cosign authentication in WebAuth module
    \item LDAP module could support any authentication type
    \item Weblogin server could log users into both systems
    \end{itemize}
  \item IIS security contexts
  \item Shibboleth for Windows IIS authentication
  \item Shibboleth integration into Weblogin display
  \item More minor cleanup, particularly better WebKDC logging
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{HTTP Negotiate Introduction}

  \begin{itemize}
  \item Kerberos GSS-API authentication over HTTP protocol
  \item Relationship to SPNEGO
  \item Right idea, questionable implementation
  \item Seems to be the best thing currently available
  \item Two Apache module implementations with different problems
  \item Need local patches to mod\_auth\_kerb
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{HTTP Negotiate Deployment Challenges}

  \begin{itemize}
  \item Browser support mostly there but annoying:
    \begin{itemize}
    \item IE configuration stupidity
    \item Safari's principal of the week
    \item Firefox library loading bugs
    \item Opera seems to just lose
    \end{itemize}
  \item Windows cross-realm and Exchange breakage
  \item User freakout about any change
  \item HTTP Negotiate hard to explain
  \item Solution: Make it optional and hide it a little
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Shibboleth}

  \begin{itemize}
  \item Solving a different problem: federated identity
  \item Good solution for hard edge cases
  \item Can be used for intranet authentication, but complex
  \item Doesn't support credential delegation
  \item \textit{Does} support IIS
  \item Looks like your other web authentication system to users
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Fitting It Together}

  \begin{itemize}
  \item Separate user interface from authentication protocol
  \item Different systems have pluses and minuses --- support them all!
  \item Shibboleth seems the only widely deployed solution to its problem
  \item LDAP integration is more important than you might think
  \item Authorization is hard but LDAP groups seem the most flexible
  \item This technology area is still very immature
  \end{itemize}
\end{slide}

\end{document}
