Sun’s OpenID IdP: Introduction

This is the first of a series of posts on Sun Microsys­tem’s OpenID@Work ser­vice, which is an Open­ID Iden­tity Pro­vider avail­able for use by Sun employees.

[Update: I was asked what the pur­pose of these post­ings is — it’s simply to share our exper­i­ences in the hope that they’re help­ful to others.]

I was part of the team that put up the Open­ID Iden­tity Pro­vider. I wrote a lot of the pages, revamped Sun­’s default style sheet to work with the HTML I wanted on the pages, and took part in all the dis­cus­sions about policies and secur­ity. I’m also the “data stew­ard” for the IdP, respons­ible for ensur­ing that our policies regard­ing data pri­vacy are car­ried out. Giv­en that range of tasks in the pro­ject, it’s no sur­prise that when we div­vied up the areas for blog­ging, I picked the policy ques­tions, and oth­er people on the team will blog about oth­er areas. We’ll be cross-link­ing to each oth­ers’ posts, of course. For example, here’s Gerry­’s intro­duc­tion.

One of the good things about work­ing for Sun is that there are a lot of people with rel­ev­ant expert­ise, who also under­stand the need to be flex­ible. We spent a lot of time dis­cuss­ing the user policy with the people in the Chief Pri­vacy Office (who also let me write it in lan­guage people can under­stand), we had secur­ity experts review not only the deploy­ment but also the Open­ID spe­cific­a­tion (they’ll be blog­ging more on those aspects them­selves), and on the tech­nic­al side many people went out of their way to help. As an example, I spent most of one week­end try­ing to fig­ure out a weird MIME type prob­lem with the web serv­er with Murthy Chint­alapati (aka cvr), him email­ing “try this”, me email­ing back “nope, did­n’t work” until we even­tu­ally solved the prob­lem. In this series I’m going to be talk­ing about a few of the issues we dis­cussed, and how we resolved them. This is not to say we came up with per­fect solu­tions, or that they are neces­sar­ily applic­able to oth­er com­pan­ies or cir­cum­stances, but at the very least they will give you things to think about if you’re con­sid­er­ing a sim­il­ar project. 

We were heav­ily influ­enced by Sun­’s exper­i­ence with blog­ging, to the extent that many of our dis­cus­sions about “should we do this” were answered by “blogs.sun.com did it suc­cess­fully and here’s how”. The sim­il­ar­ity between the user policy doc­u­ments is no coin­cid­ence, for example.

If you’re look­ing for tech­nic­al doc­u­ment­a­tion on Sun­’s Open­ID sys­tem, try Hubert Le Van Gong’s infra­struc­ture descrip­tion and Open­ID @ Work — Archi­tec­ture.