Review of OpenID

JISC has awarded funding for a project reviewing OpenID to Sandy Shaw and Fiona Culloch of the EDINA SDSS team, working with Professor David Chadwick and members of his team at the Information Systems Security Research Group, University of Kent. The use of OpenID has grown hugely in the past two years, but given the self-registration aspect of the system, does it have any application in academia?

Background

OpenID is an identity system enabling individuals to create and register an identity for themselves, which they may then use in different contexts. The self-registration approach of OpenID is in distinction to systems where the identity of the individual is independently confirmed by an organisation, such as the university or college where they are a student or staff member.

The originators of OpenID appear to have been motivated by a pressing problem in the Web 2.0 and blogging world: namely, how to comment quickly and painlessly on many blogs requiring authentication (to combat comment spam) and access the many new Web 2.0 sites – typically with an element of social networking, thus requiring some form of user identification – without forever having to create new usernames and passwords at each new site.

In the context of the ever-changing Web 2.0 world, where new players come and go rapidly, they were also keen to ensure that an end user’s identity should be controlled by the user rather than by an identity provider organisation that might change its policies or go out of business at any time, leaving its users stranded. The aim was that anyone should be able to set up their own OpenID and decide which of their identities (or personas) should be used on any occasion.

The Project

The project will combine structured interviews, technical evaluation and working demonstrators to provide material for a report which will address the following key points:

What OpenID is and is not
What other institutions have already been doing with it
What applications can be foreseen in the short and medium term
How OpenID relates to the UK Access Management Federation
Whether OpenID may be applicable to services using licensed data
How the forthcoming integration of Microsoft CardSpace with OpenID 2.0 and Active Directory might affect the large number of institutions that use Active Directory as a component of their identity management
Whether there is a foreseeable path from institutionally-managed identities to institutions providing trusted attributes about public, user-centric identities.

The report will also consider whether, and to what extent, further work in this area could usefully be directed. The project is due to complete and publish its findings in the Summer of 2008.

Review of OpenID: Project Summary