5 ms·

I simply don't understand this blog entry. I guess it's their official project resignation... OK. Even so, it seems misinformed about the adoption problems. Pe

I simply don't understand this blog entry. I guess it's their official project resignation... OK. Even so, it seems misinformed about the adoption problems. Persona, to me, seems a truly lovely solution to a difficult problem. It was successful, just at the beginning of a hard adoption curve. What's missing is fully functional, advertised implementations of the Service Provider, that work with LDAP and ideally older Kerberos backends. What's missing is the native, built-in interface. What's also missing is a SLA... big players can't adopt it unless Mozilla says they are going to support it. What's missing in Persona is a promise to have the code security audited and get it passed federal agencies. What's missing is some grass-roots effort to get it into universities. What they list as failures aren’t exactly. So, there are some UI issues.. but those aren’t the problem. The Persona service was meant as transitional, till native implementations appeared. It's not going to adopt itself, they need a "Sales Engineer" full time working on adoption. Hell, they could even charge people for that sales engineer and many would pay for it. The alternative to Persona is Shibboleth/Kerberos, and Persona kicks it.

Spearchucker 13y ago
...with LDAP and ideally older Kerberos backends. If that's what I need I'd rather use WS-Federation or SAML. Both have been around for longer, and I consequently have a lot more faith in them. Sure, they're XML-based, but that's quite ok for what I'm getting.
- 616c 13y ago
  With all due respect you probably do not work in an institution where you have to rely on SAML for day-to-day operations (I work in a uni, so Shibboleth). If you did, you would realize why SAML is lauded as a great solution, but in reality can be very fragile and needs to be rolled out all or nothing. I have been part of a multi-year piecemeal deployment and it has rough edges.
  - Spearchucker 13y ago
    I have, and know exactly what the issues are. It's why (if given the choice) I prefer WS-Fed and Active Directory. ADFS 2 for .Net is phenomenally good.
  - jms18 13y ago
    > in reality can be very fragile and needs to be rolled out all or nothing. What makes you say that? That certainly isn't my experience with Shibboleth. We deployed our IDP in 2006-07 (I think) and slowly migrated services to it.
Osmose 13y ago
Note that this isn't a blog entry, it's a wiki page. We (Mozilla community) often use the Mozilla wiki as a place to store long-term notes or information. Barring vandalism (which this isn't), you can think of it as a public internal wiki for Mozilla, that has pretty much everything we're allowed to make public (Unlike HR stuff for employees, which goes on an internal wiki) that we want to write down. (This doesn't address your argument, just wanted to clarify that)
- maxcan 13y ago
  So, to confirm, is it a post-mortem or not? I'm about to launch a fairly big project using Persona and would love to know if its a bit to get shut down..
  - plierhead 13y ago
    Same! So far, it seems to me that persona is an incredibly useful technology in our space (Enterprise SAAS apps). Our space is populated by lots of apps that have various shitty login systems, but one thing they pretty much all have in common is an email address - and Persona seems to be a killer SSO system for securely leveraging/livening up these existing databases of email addresses. Unless I'm missing the point, I don't see much alternative either. Just looking at the traffic from the Persona communit reinforces to me that I never want to be building my own authentication system - even if persona were to die as a project I would be better off cloning it than writing my own (or giving in and using social login, which is pretty undesirable in the enterprise world).
  - cryptolect 13y ago
    There's a fairly active mailing list over at dev-identity@lists.mozilla.org. If you have a heavy investment in Persona, I'd recommend you ask there.
- jessaustin 13y ago
  I admire Mozilla's openness, and the existence of TFA is an example of that, but in this case it amounts to really poor communication with the rest of the world. Why all the past tenses? Would it have killed anyone to say "What does Persona get right?" or "Why has Persona failed to gain wide adoption so far?" The whole attitude here is bizarre. It seems Persona is supposed to have taken over the world by now, while in reality it's not clear that it's even in beta, let alone out of it. E.g., we're supposed to get the javascript lib from one place only, because we're warned that the protocol could change in breaking ways at any time. Let's get to version 1.0 before complaining that facebook hasn't been driven out of business! I support the recommendations to simplify and get rid of sessions.
lukeh 13y ago
s/Service Provider/Identity Provider (IdP)/ Service Provider is usually a synonym for Relying Party (RP), which is the service that's relying on your authenticated identity, typically a web server. The rest, all good points.

Spearchucker 13y ago

...with LDAP and ideally older Kerberos backends. If that's what I need I'd rather use WS-Federation or SAML. Both have been around for longer, and I consequently have a lot more faith in them. Sure, they're XML-based, but that's quite ok for what I'm getting.

616c 13y ago
With all due respect you probably do not work in an institution where you have to rely on SAML for day-to-day operations (I work in a uni, so Shibboleth). If you did, you would realize why SAML is lauded as a great solution, but in reality can be very fragile and needs to be rolled out all or nothing. I have been part of a multi-year piecemeal deployment and it has rough edges.
- Spearchucker 13y ago
  I have, and know exactly what the issues are. It's why (if given the choice) I prefer WS-Fed and Active Directory. ADFS 2 for .Net is phenomenally good.
- jms18 13y ago
  > in reality can be very fragile and needs to be rolled out all or nothing. What makes you say that? That certainly isn't my experience with Shibboleth. We deployed our IDP in 2006-07 (I think) and slowly migrated services to it.

Osmose 13y ago

Note that this isn't a blog entry, it's a wiki page. We (Mozilla community) often use the Mozilla wiki as a place to store long-term notes or information. Barring vandalism (which this isn't), you can think of it as a public internal wiki for Mozilla, that has pretty much everything we're allowed to make public (Unlike HR stuff for employees, which goes on an internal wiki) that we want to write down. (This doesn't address your argument, just wanted to clarify that)

maxcan 13y ago
So, to confirm, is it a post-mortem or not? I'm about to launch a fairly big project using Persona and would love to know if its a bit to get shut down..
- plierhead 13y ago
  Same! So far, it seems to me that persona is an incredibly useful technology in our space (Enterprise SAAS apps). Our space is populated by lots of apps that have various shitty login systems, but one thing they pretty much all have in common is an email address - and Persona seems to be a killer SSO system for securely leveraging/livening up these existing databases of email addresses. Unless I'm missing the point, I don't see much alternative either. Just looking at the traffic from the Persona communit reinforces to me that I never want to be building my own authentication system - even if persona were to die as a project I would be better off cloning it than writing my own (or giving in and using social login, which is pretty undesirable in the enterprise world).
- cryptolect 13y ago
  There's a fairly active mailing list over at dev-identity@lists.mozilla.org. If you have a heavy investment in Persona, I'd recommend you ask there.
jessaustin 13y ago
I admire Mozilla's openness, and the existence of TFA is an example of that, but in this case it amounts to really poor communication with the rest of the world. Why all the past tenses? Would it have killed anyone to say "What does Persona get right?" or "Why has Persona failed to gain wide adoption so far?" The whole attitude here is bizarre. It seems Persona is supposed to have taken over the world by now, while in reality it's not clear that it's even in beta, let alone out of it. E.g., we're supposed to get the javascript lib from one place only, because we're warned that the protocol could change in breaking ways at any time. Let's get to version 1.0 before complaining that facebook hasn't been driven out of business! I support the recommendations to simplify and get rid of sessions.

lukeh 13y ago

s/Service Provider/Identity Provider (IdP)/ Service Provider is usually a synonym for Relying Party (RP), which is the service that's relying on your authenticated identity, typically a web server. The rest, all good points.