Ideas on how one might implement an IP-address-based weak authentication mechanism for uPortal.
High Level Discussion
There's a whole lot of public content
There's a great deal of public information available. The Web, for instance, is largely publicly available information. Some amount of this information is suitable for presentation as uPortal channels. One way we customize the public information that individual users receive – one way we provide value in portals – is by allowing the user to authenticate and receive a layout populated with information that she has chosen or someone has chosen for her from the universe of available content, which includes both public content (authentication was for the purpose of identifying her preference to see this particular public content) and private content (authentication was for the purpose not only of identifying her preference to see this particular content but was also for the purpose of authorizing her to see the content.)
We can make meaningful gueses about what public content a user might want to display before she logs in
While there is no substitute for the full power of user authentication to see private content and a truly personalized, end-user-configured, layout, we can nonetheless make some educated guesses about what in the universe of available content we wish to present to a non-authenticated user.
A persistent per-user cookie
Conceivably, uPortal could place a persistent per-user cookie that would inform the guest layout. It might result in the user being "logged in" and those channels that display public information would render – if the user layout itself is not regarded as private information. Alternatively, one might allow the user to configure a custom guest layout consisting only of publicly available channels.
IP address tricks
The user IP address conveys a lot of information. From it, you might be able to determine:
- that a computer was registered to receive an IP address, and by whom it was registered
- whether the computer is an institutional cluster computer, if so what kind and where
- whether the computer is on a residential or administrative subnet
- what institution the computer is at, in the case of a uPortal serving multiple institutions.
- which School within a University the request is likely coming from
Of course, it's inappropriate to use IP address for authentication – there are too many well know IP address spoofs – but it's a plausible way to filter and customize public information.
We might use this IP address information to select an entire layout, or we might use it to inform the content to be displayed by particular channels.
Network Registration
At Yale one year we placed a channel on our guest layout front page that, based on the IP address of the request, would detect the case where the request was likely coming from an unregistered computer on a student subnet and in that case displayed an invitation to "Click here to register your computer!".
Single Sign On
Incidentally, Single Sign On has something to offer here. If a user has only to authenticate once and then her entire web session is authenticated, and if resources she accesses can detect this authenticated state and jump directly to logged in state, then the need to play these non-logged-in guessing games is lessened. Logging in is a good thing. The authenticated experience should be so compelling, so effectively present exactly what the user didn't even realize she was eager to know, that users should be logging in.
On predicating guest content display upon requestor IP address
Yale's SAM Kiosks
If you visit YaleInfo Portal from Service and Maintenance Kiosks distributed throughout campus, YaleInfo detects that the IP address of the kiosk is in the set of SAM Kiosk addresses and switches to present an alternate guest layout. This trick allowed Yale to rapidly deploy an alternative guest layout, using the existing uPortal installation to provide a second public view customized to the particular needs of this kiosk project.
Here's an alternative implementation story that treats IP Address as an authentication mechanism:
Use Case
On the basis of the IP address, we will categorize our users into one of three categories:
User categories |
|---|
Yale user |
Rutgers user |
unknown |
We have a different Layout consisting of channels presenting public information that we want to associate with each of these groups.
When a user accesses our portal, he is to be categorized based on his IP address into one of these three categories. The portal must present the layout and content associated with that category. The portal must also offer the opportunity to authenticate. Authentication results in a layout based on the user's authenticated identity: a Yale user visiting Rutgers will receive the Rutgers guest layout but upon authentication will get the Yale layout if he has not personalized or his very own layout if he has edited his layout.
When users truly authenticate, they will do so using CAS.
Implementation
Model the categories of un-authenticated users as dummy users.
We already have a generic "guest" user. Additionally we will have a yale_guest and a rutgers_guest.
We assign these users the layouts we want to present to their respective category of users.
Implement the Authentication
We will have a Union authentication context. That union will be configured to stop on success. In the union will be the YaleCASFilteredContext first. Second it will have the IPAddressContext, which we are about to invent.
YaleCASFilteredContext is well documented elsewhere. It gets first dibs because we want a user's explicit (stong) authentication to override the weak IP-address based "authentication" we're about to implement.
IPAddressContext will examine the user's IP address and authenticate as either yale_guest or rutgers_guest as appropriate. It does some clever pattern matching on the IP address.