OpenID review

The JISC are currently funding a review of OpenID, looking at its potential use in higher education.  The review will do this by:

• Determining potential use cases through structured interviews with a representative sample of stakeholders throughout the academic community;
• Evaluating the potential use cases by performing a risk assessment of them using the known security and trust properties of OpenID, in order to determine a set of valid use cases;
• Building working demonstrators to ensure our understanding of the technology is robust. to allow the community to experiment with OpenID within the context of the UK Access Management Federation, and, if possible, addressing a sample of the valid use cases, using federation compliant Identity Providers;
• Producing a final report describing our conclusions and recommendations for the future use of OpenID in the UK academic community.

Looks interesting.  The work is being lead by Sandy Shaw at EDINA and is due to complete in June this year.

Comments

[Tony Hirst]

KMi at the OU are currently runner an OpenID server at http://openid.open.ac.uk/

The server gives anyone who has an OU id (OUCU) an openid (of the form http://openid.open.ac.uk/oucu/OUCU if i remember correctly).

So i guess that means we have in principle enabled 150,000 openids... (though I'm not sure how well the server will scale!);-)

Alex Little, who set it up, also enabled the MSG lite instant messenger (Jabber) to accept openid authentication: http://msg.open.ac.uk

MSG is open for registration to all comers, and open source too, i think?

[Phil Wilson]

Yes, there is anon-access CVS to MSG.

Why do JISC do this work? Is it so that institutions don't