These days, [proxy/broker/hub/exchange architecture often comes up when discussing public sector service delivery]. A related topic is [component identity services]. And all of that is wrapped up around the ongoing discussion around value propositions, security, privacy, risk, and liability. These are some initial thoughts on bringing some of those topics together.
The typical model that I see associated with a proxy deployment is one I will call a Unified Proxy, in which the brokering of both the token information and the identity information is done by the same entity:
Single point of RP integration
Single point of Token/Identity/CSP integration
Single point of policy compliance
Potential aggregation of risk
Accountability for policy compliance is distributed
RP concerns with attribute aggregation outside its security boundary
Melding of different liability/pii concerns when tokens and identity are handled by same party
Another alternative is what I will call a Split Proxy, in which there is a physical (and not just logical) separation between the brokering of the token information and the brokering of the identity information:
Separation of concerns when it comes to tokens and identity
Clearer accountability when it comes to policy compliance
RP has a choice of deploying the attribute validation proxy within its trusted domain
May be easier to separate out liability/pii concerns
Business value is long term and nuanced
Technical value is harder to convey due to increased complexity
Risk inherent in added complexity</l>
RP integration may not be plug-n-play
What are some other benefits and challenges of either model?
* [What Capabilities are Enabled by Public Sector Federated Identity Platforms?]
* [Is a CSP In a Federation, Without Identity Attributes, a Token Manager?]
: https://blog.aniljohn.com/2013/11/capabilities-enabled-by-federated-identity-platforms.html "What Capabilities are Enabled by Public Sector Federated Identity Platforms?"
: https://blog.aniljohn.com/2013/12/is-a-csp-without-attributes-a-token-manager.html "Is a CSP In a Federation, Without Identity Attributes, a Token Manager?"
Did you find this interesting? Don't miss any new posts. Sign up to automatically receive them now!
This blog post first appeared on Anil John | Blog (https://blog.aniljohn.com). The opinions expressed here are my own and do not represent my employer’s view in any way.
Disclaimer: The opinions expressed here are my own and do not represent my employer’s view in any way.
I am a Public Interest Technologist. I help technical leaders gain clarity and understanding on complex architecture, information security and privacy practices, so they can enable secure, trustworthy digital services. More about me →