FOAF+SSL: Secure, RESTful, Single-Sign-On Authentication

Ian Jacobi, Henry Story, Toby Inkster, Melvin Carvalho, et al.

27 July 2009

Overview

What is FOAF+SSL? Why is it needed?
How FOAF+SSL works
Building authorization on top of FOAF+SSL

What is FOAF+SSL?

A RESTful, secure, open authentication framework
Like OpenID, with security by default and no provider
Implemented seamlessly on top of SSL

Why FOAF+SSL?

Linking common semantic representation to user token
Distributed ACLs
Protecting sensitive data on the Open Social Network

Technical Background - FOAF

"Friend of a Friend" vocabulary
A defacto RDF standard for describing a person
Semantic Web-based vocabulary
Gives an individual a URI

FOAF+SSL - The Protocol

The user requests the page and, during the establishment of an SSL connection with the server, provides a self-signed certificate containing a pointer to the user's URI. The server 'dereferences' the user's URI and attempts to verify the public key of the client certificate against information at the user's URI. If the key is properly verified, the user's URI can be trusted as 'owned' by the user.

FOAF+SSL - Adding Authorization

Only establishes control of a URI
FOAF URI and certificate allow for establishing trust (PKI/Third-parties)
Self-signing clients are okay: Web-of-Trust works better with clients than servers
Can use URI as unique identifier for policy reasoning

FOAF+SSL - Adding Authorization

Once the user's URI can is trusted as 'owned' by the user, the URI may be used to reason about whether a user is authorized to access a particular resource.

Use Cases

Single-sign-on web service user identification (as in OpenID)
Single-sign-on web service personalization (linking social networks)
Single-sign-on for other services (XMPP)
(Distributed) HTTP access control

FOAF+SSL Resources

Up-to-date links on the ESW Wiki
FOAF+SSL Position Paper: "FOAF+SSL: Adding Security to Open Distributed Social Networks"
Ongoing discussions on the foaf-protocols mailing list
FOAF+SSL at Sun:

Redistribution License