Hacking WordPress Login and Password Reset Processes For My University Environment

Tue, 29 Sep 2009 16:16:16 +0000

Any university worth the title is likely to have a very mixed identity environment. At Plymouth State University we’ve been pursuing a strategy of unifying identity and offering single sign-on to web services, but an inventory last year still revealed a great number of systems not integrated with either our single sign-on (AuthN) or authorization systems (AuthZ, see difference). And in addition to the many application/system specific stores of identity information (even for those systems integrated into our single sign-on environment), we also use both LDAP and AD (which we try to synchronize at the application level). Worst of all, the entire environment is provisioned solely from our MIS database, which is good if you want to make sure that students and faculty get user accounts, but bad if you want to provision an account for somebody who doesn’t fit into one of those roles.

The one way relationship between our user accounts and the MIS database also makes it difficult to engage with new users online. If you can’t get an account until you become a student, how do you allow potential students to apply online if all your systems are integrated with single sign-on? And if you can’t authenticate the online identity of your users, how do you set initial passwords into your system? Or allow them to reset a forgotten password online?

Internet companies never struggled with this issue, as their customers could only approach them online, but most universities built systems around paper applications and have fond (and relatively recent) memories of offering their students their first internet experience. It’s still not unusual for universities to offer their students their campus computing account with a default password based on supposedly secret data shared between the user and the school. But your SSN, birth date, and mother’s name are no longer secret. A proposed change in FERPA policy (see the the top of page 15586 in the NPRM) would have barred the use of “a common form user name (e.g., last name and first name initial) with date of birth or SSN, or a portion of the SSN, as an initial password to be changed upon first use of the system” in systems that store academic data. The final rule excluded that provision, much to the relief of those schools with more lobbying clout than brains.

CAS Is A Standard Protocol, Not A Standard Application

Tue, 14 Apr 2009 16:52:09 +0000

I’m not really part of the Jasig CAS Community (learn more), but I do maintain the wpCAS WordPress CAS client and I’ve started development of a CAS server component for WordPress.

Identity Management Going Commodity?

Tue, 08 Apr 2008 01:56:30 +0000

Atlassian’s Crowd SSO and IdM solution has the kind of online pricing you’d expect for word processing software.

Google Pumps OpenID Too

Sat, 19 Jan 2008 16:21:04 +0000

Following news that Yahoo! is joining the OpenID fray, it appears Google is dipping a toe in too.

Yahoo! Pumps OpenID

Fri, 18 Jan 2008 12:49:44 +0000

Ars notes that Yahoo! supports OpenID. Yeah, that OpenID.

single sign on on MaisonBisson

Hacking WordPress Login and Password Reset Processes For My University Environment

CAS Is A Standard Protocol, Not A Standard Application

Identity Management Going Commodity?

Google Pumps OpenID Too

Yahoo! Pumps OpenID