User Privacy with Composite Applications
Composite applications contain multiple services used in combination. In order to do so, they are using user-centric federated identies.
How we may achieve the goal of a flexible, user-centric identity management infrastructure which will allow the user to quickly determine what information will be revealed to which parties and for what purposes, how trustworthy those parties are and how they will handle the information, and what the consequences of sharing their information will be?
Group audience:
Comments
Thay are not trustworthy -
Thay are not trustworthy - what you do is to ensure that no party is able to identify the citizen so all parties act as one. Especially if it goes into cloud.
SAML is otherwise dangerous as it provides the abolity to scale attacks so successfull penetration in one systems spreads to other systems. This can only be mitigated through logical isolation so nothing you lean in one context can be reused to attack another context/system.