Microsoft hoping to make Passport universal with maimed Kerberos

In a move aimed at helping MS Passport become a universal verification service, Microsoft has announced that it will be expanding the Passport sign-in service to be interoperable with company intranets, websites and other networks, in order to

In a move aimed at helping MS Passport become a universal verification service, Microsoft has announced that it will be expanding the Passport sign-in service to be interoperable with company intranets, websites and other networks, in order to 'deliver trusted, universal single sign-in spanning multiple organizations and services.'

In a press release sent out yesterday, Microsoft's group VP of .NET Services, Bob Muglia, said "We invite the industry to participate in this federated model that bridges today's islands of authentication into a trusted network for users, Web site operators, wireline and wireless carriers, and corporations that will unlock the power of Web services, which is the foundation of our .NET vision."

As part of Microsoft's new strategy, Passport will be modified to support Kerberos tickets, a widely used method of authentication. However, according to El Reg , Microsoft's implementation of Kerberos does not adhere to the Kerberos standard.

Kerberos is an authentication service. Users present Kerberos servers with a username and password, and they receive a 'ticket' that verifies their identity. This ticket can then be presented to any properly configured authorisation server, which will decide how and what you can access, based upon your ticket. The reason that the Kerberos server cannot perform both authentication and authorisation itself is because no one can agree on the best way of implementing authorisation into the Kerberos protocol. Realising this, all players involved in Kerberos have agreed to not pollute the existing Kerberos authentication ticket with extra information. Well, all involved players with the exception Microsoft.

Microsoft's implementation of Kerberos actually includes an authorisation in the Kerberos ticket. This means that the only Kerberos tickets a Microsoft OS will recognise and validate, are tickets generated by other Microsoft based Kerberos servers.

The downside here should be obvious. If you want to use Kerberos in conjunction with Passport, you must be using a Microsoft OS. Normally this would not be a problem, as non-Microsoft customers would simply use a normal Kerberos server. The real problem comes when websites and online businesses (Amazon for example) decide to use Passport for their user authentication. If this happens, non-Microsoft OS users will be locked out of using these services.

We are all familiar with Microsoft's 'Embrace and Extend' philosophy. However, when that philosophy starts to affect who can use online services and how they can use them, based solely on what operating system you have chosen, it begs the question; Do we really want a proprietary technology from any vendor being used so widely, that it is capable of controlling our online experience?