VETUMA

1
(No Transcript)
2
VETUMA

• Government-funded web-authentication portal
• Provides one (documented, open) interface for
  multiple strong authentication services,
  including
• Bank authentication (most popular)?
• Certificate card authentication (government
  FINEID for the public)?
• Mobile phone authentication (several methods,
  including FINEID)?
• User authentication, digital signatures, money
  transfers(with bank authentication)

3
Getting it

• So far, the government has paid for about half of
  the expenses for user organisations
• The government has also licenced the offical
  Vetuma client software(Java) for free to
  government use
• University of Helsinki develops its own free
  software implementation of the Vetuma client (in
  Perl)?
• First version was made as a pilot project for the
  CSC

4
Use cases for strong authentication by VETUMA

• Password resetting service
• Registering new users online
• Creating one-time password lists
• Technically also possible to combine with a
  public IDP for a Shibboleth federation
• Too expensive for daily tasks such as
  authenticating workstations etc.

5
Password resetting service

• Password resetting for multiple user account
  types
• Edirectory, Active Directory, Unix
• Two different interfaces
• LDAP
• homegrown web service

6
User account creation

• Web forms where the strongly authenticated user
  is guided through the user account creation
  process
• So far, at least 75 of new students have
  succeeded in using the service
• Some of the rest however, among other things
  tried to use borrowed bank account codes to
  authenticate themselves..
• Also, students seem reluctant to read all the
  text they should when given a user account for a
  university network

7
Other things to notice

• As the authentications cost money to the
  university, access to the service must be limited
  to a reasonable number of attempts (by social
  security code and ip-address)?
• Making the directions for the service is a lot of
  work, especially in 3 different languages
• It would be possible for HU to compete with the
  Vetuma service by implementing the multiple
  interfaces directly

8
What?