Home arrow Community arrow FORUM arrow Technology matters arrow General Technology Chat arrow Web Authentication Needed
Web Authentication Needed

Forum Menu

Home  Help  Search  Login  Register 


Pages: [1] Go Down  
Send this topic Print
Author Topic: Web Authentication Needed  (Read 8101 times)
mr_mahoney
Active Member
**


Posts: 31
Karma: 0
Offline Offline


View Profile WWW
« on: April 17, 2007, 06:55:08 PM »

I foresee a need for a special web page that requires a login by a student using a handheld.

Problem:  users with internet phones, PDAs, PSP, ect can get on the internet and my filter does not know who they are.  If I still want them to have access, I need to know who they are.


Possibility?  I need a web page that recognizes a user of a handheld ( could be based on screen size less than 640x640 )

Then the web page would prompt for a user name and password (that would reference a user database - LDAP ? )
If the user is in the database, then they can browse the internet.

It could almost work like the disclaimer page mentioned on the list earlier.

I have seen this done at a hospital for their WIFI .

Any ideas?  I really feel this is worth pursuing.
Logged
Michael Wilkinson
Active Member
**


Posts: 55
Karma: 3
Offline Offline


View Profile WWW
« Reply #1 on: December 12, 2007, 06:56:51 PM »

Hi
I think what you actually need is a proxy authentication linked to both the wireless and the 3G/GPRS connections. This a) can authenticate if a user can browse the net b) can support filtering and c) give you some management information.
I am presently working with a company called GAIST (www.gaist.co.uk) who provide a web filtering solution which works like this.
Logged
stu_mob
Full Member
***


Stuart Smith, University of Manchester

Posts: 130
Karma: 4
Offline Offline


View Profile WWW
« Reply #2 on: December 14, 2007, 03:02:33 PM »

There are lots of options, depending on what branch of education you are working in and exactly what you are trying to protect.

I have just re-written an Athens web page to be mobile friendly and it so far it seems OK. My big concern at the moment for education has got to be Federated Access (sometime called Shibboleth), which is the 'next big thing' certainly in HE and FE. That really hasn't been designed with mobile access in mind. So althought the technology should be OK the interface is appalling.

I think there are loads of options and most you won't need to pay for. Since most phone and pda browsers have similar security features to desktops now (always expceptions of course).

So the basic principle is if it works on the desktop - it should (in theory) work on the mobile. Its the interface that will cause you the biggest problem.
Logged

Michael Wilkinson
Active Member
**


Posts: 55
Karma: 3
Offline Offline


View Profile WWW
« Reply #3 on: December 14, 2007, 06:03:35 PM »

Another SSO worth a mention is CAS (Central Authentication System) http://www.ja-sig.org/products/cas/
Much easier to implement than SHIBBOLETH. The main difference is with SHIBBOLETH institutions keep overall control over their own data - with CAS so need to worry about the data - the master system (server) so perhaps the Learning Platform handles the authentication and the client system (i.e. I am learning - revision system) trusts the request for access.
I am just looking at this for LP integration and also for a JISC and QIA project.
Logged
stu_mob
Full Member
***


Stuart Smith, University of Manchester

Posts: 130
Karma: 4
Offline Offline


View Profile WWW
« Reply #4 on: December 17, 2007, 11:41:21 AM »

That's useful to know Mike. Does CAS work with Federated Access?

My main concern about Federated Access is the Waif and the long lists of names you end up having to plough through. I really don't want to see authentication becoming a big issue for users but fear it might. It's hard enough trying to get user engagement as it is!!
Logged

Michael Wilkinson
Active Member
**


Posts: 55
Karma: 3
Offline Offline


View Profile WWW
« Reply #5 on: December 18, 2007, 02:39:16 PM »

Hi Stu
It does support federated access.
This is an interested JISC case study which looks specifically at authentication:
http://www.jisc.ac.uk/media/documents/themes/accessmanagement/cc297d002-1.0%20case%20studies%20supplement.pdf
I agree - authentication should not be made complex.

As another solution for SSO I have been writing a Cryptographic nonce and using SHA1 Hasf Function
en.wikipedia.org/wiki/Cryptographic_nonce
en.wikipedia.org/wiki/SHA1
Logged
stu_mob
Full Member
***


Stuart Smith, University of Manchester

Posts: 130
Karma: 4
Offline Offline


View Profile WWW
« Reply #6 on: December 20, 2007, 02:50:58 PM »

Thanks for the pointer to the report Michael.

Not had much of chance to read through it (something for Christmas I guess! Wink but I think it will be interesting.

It would be good a practical level if this forum can be encouraged to raise concerns about Federated Access and mobile devices because it really is not been thought through yet. The main problems I forsee are usability ones but they need addressing now before large scale adoption.
Logged

Pages: [1] Go Up  
Send this topic Print
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.5 | SMF © 2006-2008, Simple Machines LLC

© 2008 handheld Handheld Learning

Valid XHTML 1.0! Valid CSS!

Login

Welcome, Guest. Please login or register.
November 22, 2008, 02:54:10 AM
Username:

Password:


Login with username, password and session length
Forgot your password?

Polls

What did you enjoy most at HHL 08 this year?
  



RSS RSS