I’ve always found Kerberos to be an interesting protocol. It works by way of a trusted third party which issues secured tickets based on an authentication or previous session. These tickets are used as proof of identity by asserting that the subject is who they claim to be. Claims authentication works on a similar principle, except instead of a ticket you have a token. There are some major differences in implementation, but the theory is the same. One of the reasons I find it interesting is that Kerberos was originally developed in 1983, and the underlying protocol called the Needham-Schroeder protocol, was originally published in 1978.
There have been major updates over the years, as well as a change to fix a man-in-the-middle attack in the Needham-Schroeder protocol in 1995, but the theory is still sound. Kerberos is the main protocol used in Windows networks to authenticate against Active Directory.
The reason I bring it up is because of a comment I made in a previous post. I made an assertion that we don’t necessarily abstract out the identity portion of our applications and services.
Well, It occurred to me that up until a certain period of time, we did. In many environments there was only one trusted authority for identity. Whether it was at a school, in a business, or within the government there was no concept of federation. The walls we created were for a very good reason. The applications and websites we created were siloed and the information didn’t need to be shared. As such, we created our own identity stores in databases and LDAP directories.
This isn’t necessarily a problem because we built these applications on top of a foundation that wasn’t designed for identity. The internet was for all intents and purposes designed for anonymity. But here is where the foundation became tricky: it boomed.
People wanted to share information between websites and applications, but the data couldn’t be correlated back to the user across applications. We are starting to catch up, but it’s a slow process.
So here is the question: we started with a relatively abstract process of authentication by way of the Kerberos third party, and then moved to siloed identity data. Why did we lose the abstraction? Or more precisely, during this boom, why did we allow our applications to lose this abstraction?
Food for thought on this early Monday.