Open ID Connect at CSAIL

If you've been around MIT - more especially at CSAIL - for a while, you have probably become accustomed to using "web certificates" as a way to log yourself into the various Web-based applications around campus, like Atlas, Peeps, and many other popular sites. MIT adopted the use of web certificates in 1996 to allow its community a way to log into many different sites without having to remember a username and password for each site.

Fast forward a decade or so, and a new kind of central login method was adopted at MIT: Touchstone, which not only allowed users to use web certificates, but also allowed them to use their Athena username and password, or even existing Kerberos tickets (see http://kb.mit.edu/confluence/display/istcontrib/Touchstone+FAQ for more info).

Fast forward another decade, and CSAIL has begun the adoption of the next generation login system: Open ID Connect, or OIDC. MIT central campus also has a pilot program for OIDC; however, they are less motivated to get it integrated into campus applications because they already have Touchstone. CSAIL is highly motivated to roll our OIDC because in the very near future, major web browser vendors like Mozilla and Google will end support for web certificate authentication in their browsers. In fact, OIDC at CSAIL will be replacing web certificates entirely for client authentication.

What is Open ID Connect?

There's a technical description of OIDC you can read at http://openid.net/connect/ if you want to know all the details, but in short, OIDC is a service that we run at CSAIL on our own servers that allows you to authenticate to services like WebDNS, DHREG, the CSAIL website, and many more, by using your CSAIL Kerberos account.

The short video below shows how you would interact with Open ID Connect to authenticate to a CSAIL website (https://webdns-new.csail.mit.edu - note that this is a testing system and is not currently meant for production use).

You'll notice that the following happens in the video above:

That's pretty much all you need to do on a day to day basis. Note that you will no longer need to obtain certificates every year or worry about which one(s) you have in your browser. You can also use pretty much all the modern browsers.

-- MarkPearrow - 19 May 2017
Topic revision: 28 Jul 2017, AaronBoyle
 

MIT Computer Science and Artificial Intelligence Laboratory

 

  • About CSAIL
  • Research
  • News + Events
  • Resources
  • People

This site is powered by Foswiki MIT: Massachusetts Institute of Technology