Identity, Directories, and LID

I wish that I had more hours in the day. I have been wanting to respond to an e-mail from Johannes Ernst (I swear I will! I'm reading the LID docs again!) for weeks now ... and I also wanted to reply to this post that he wrote the other day.

In his post, he comments on some of the comments that I made about directories, and I wanted to clarify a couple of points. He lists three issues that I will address here:

• LID is decentralized and does not depend on any directory (we'll talk about some exciting consequences of that in a few weeks... stay tuned)

I am in full agreement, and my directory solution is also fully decentralized. Anyone that knew me at Novell during our years of work on digitalMe knows that I was a maniac about a project out of our labs in India called "Personal Directory." You can still go and download a copy and check it out. This is a full blown LDAP v3 directory service that can run on your desktop. In my perspective of how directories can be integrated and used for identity, I do not believe in "one big directory in the sky", nor "a bunch of directories", but instead see these running everwhere.

As I started to read the LID documentation, I realized that I could probably put an LDAP directory behind the LID protocols, and serve information directly from the directory. The benefit here is that directories like this are already in use in thousands or millions of businesses out there ... so leveraging this existing base of identity information just happens.

• access control "down to the attribute level" is all fine, but unless the person owning the identity is in control, it won't be used much (most directories I've seen are all-or-nothing things, and maintaining all of those rights centrally quickly becomes so expensive that few do it)

Yes! This was one of the core benefits we were working on with digitalMe ... a way for users to manage their own identity, and also the synchronization of their attributes - selectively - into other personal and community directories. The power that we were exploiting was a standard feature of Novell's directory implementations ... the ability to easily determine who could access/modify any object down to the attribute level. We then worked on automating the process of a local agent keeping your identity information up to date with the personal and community directories where you had defined a relationship.

• he doesn't talk about how this would work across the boundaries of a directory, or an organization.

Hopefully, some of my explanation above reveals some of what we were exploring. With digitalMe, I would have my 'personal directory' where I would have an object representing me to keep my own personal identity information, along with objects representing friends, family, and associates that I have relationships with. Corporations or other communities would then have their own directories containing objects representing the identities of their members and associates ... one of those objects might represent me if I have a relationship with that entity.

As part of our redundancy and fault tolerance plans, we had also looked to the future where I might also replicate my directory to other computers (my home computer?) or hosted directories (a bank?) so that there is no single point of failure or loss.

One of the areas that I really like LID, and to think about integration with directories, is the layers of abstraction that can be implemented. I could easily modify the index.cgi (ok ... if I had some spare time!) so that it uses a directory to obtain the user attributes, instead of the various vCard and FOAF xml files. If the LID request also passes through the credentials of the requestor, then the directory would automatically return only the attributes visible to that requestor. If I still wanted the foaf.xml or vcard.xml files, I could generate these dynamically on the fly - from the directory - as an alternative. In a business environment, there might already be a directory that contains a great deal of information about me.

Overall, I really like what I see with LID ... I'm going to continue reading and maybe play with the scripts. Maybe I'll make the time to do some modifications ... ;-)