Growing need for Social Intelligence

In the past, there were firewalls, employee agreements and corporate training to inculcate proper corporate etiquette in employees. As an employee, you were told that

• when you are in public, then sensitive corporate information was not to be uttered.
• when you were sending an email outside the organization, your language/tone had to be watched.

Companies needed to maintain vigil and dilgence to safeguard their secrets, brand and Intellectual Property. Ok, that was the 90s.

Then came the world of blogging. Wikipedia became the de-facto encyclopaedia of the world. Then came LinkedIn, Twitter, Facebook, Foursquare and your-favorite-social-network-or-location-or-web2.0-application came into existence and started getting popular. Of course, I did not forget Pinterest and Instagram.  The iPhone revolutionized mobility. Who has not clicked a picture of a place or product or something and published on twitter/facebook?  Instagram makes that easy.

This is the 21st century I am referring to.  Companies started to get involved in social media to maintain brand recognition, marketing and customer outreach.Nothing wrong with that.  Many companies encouraged their employees to embrace openness and use social media.

Things seem to be going well for everybody. I am sure we will see some employee crossing the line and mistakenly sharing private confidential information on the internet. Remember congressman Anthony Weiner 's episode of forgetting to use "D" at the beginning of his tweet. Rather than the tweet going as a direct message to one of the twitterers, it got shared with the world. The rest is history.

Reading Network World's latest bit on security and social media, I strongly feel that there is a need for Social Intelligence.  Rather than people monitoring the social media to see if private information is getting divulged, we need intelligent software that can monitor the social world to flag rumours and threats to corporate brand.  I believe many a times, employees step the thin line. not because they want to harm their employer, but because they do not know where the line starts and where it ends.

Let there be Social Intelligence not to monger fear but as a valuable tool in safeguarding corporate brands and IP. Companies should not take the knee-jerk policy of banning social media from the enterprise. What you end up doing is lowering your employee morale, in this brave new world. Just manage your brand better via social intelligence.

JBoss AS 7:: Social Login (Facebook Connect/ Google Authentication)

Background

There is no denying that Social Media is growing leaps and bounds. The concept of social login has prevailed.  Facebook and Google have turned out to the holders of user information that can be used to be the secure gateway into your web applications. Facebook / Google Users are part of what is called "Consumer Identity".
In this article, we will look at a simple web application as part of the PicketLink Social Project, that can help you visualize addition of Facebook Connect / Google Authentication to your web applications.  We will use the fast, free and awesome JBoss Application Server v7 as the runtime.

What is needed?

You will need to get hold of

• JBoss Application Server v7.1 (at the time of writing, v7.1.1.Final was the latest). 
• Use the self contained picketlink-reg.war.

Steps to follow

1. Follow the JBoss AS7 user guide to extract the server.  It is mainly just unzipping a zip archive.
2. Now copy the attached picketlink-reg.war to standalone/deployments directory of JBoss AS7.
3. You need to make some configuration changes to standalone/configuration/standalone.xml file to add a security domain as well as a bunch of system properties.
4. Start JBossAS7 in the standalone mode. 
5. Test the Web Application.

Configuration Changes to be made in standalone.xml

TIP:  I do attach my "standalone.xml" to this LINK.

 Define a security domain called "external_auth"

<subsystem xmlns="urn:jboss:domain:security:1.1">

<security-domains>

<security-domain name="external_auth" cache-type="default">

<authentication>

<login-module code="org.picketlink.social.auth.ExternalAuthLoginModule" flag="required"/>

authentication>

security-domain>

<security-domain name="other" cache-type="default">

 What Ihave done is inserted a block of security domain configuration inside the security configuration and before the security domain "other".

Define a bunch of system properties.

extensions>

<system-properties>

<property name="CLIENT_ID" value="Insert_your_client_id"/>

<property name="CLIENT_SECRET" value="Insert_your_client_secret"/>

system-properties>

<management>

<security-realms>

We have defined a block for system properties at the end of the block for extensions and the beginning of management.  Please have a look at the wiki article on JBoss AS7 System Properties, for more information.

Note that I am assuming that your app is deployed on localhost.  If the domain is different, then you have to define an additional system property called "RETURN_URL" that gives a value such as "http://thedomain/picketlink-reg/auth"  (replace thedomain with whatever value you want).

How to test the web application?

You can go to http://localhost:8080/picketlink-reg/
Now you can login either using Facebook Connect or Google Authentication.
Note that the attached web application just outputs the name of the authenticated user and the email address.  You can get more information if desired by changing the configuration settings.

What changes do we need to make a web application use Facebook Connect or Google Authentication as its Authentication Mechanism?

You will need to configure the ExternalAuthenticator in WEB-INF/jboss-web.xml   Look at how the attached picketlink-reg.war application does it.


Reference
https://issues.jboss.org/browse/PLFED-272

Attachments

picketlink-reg.war is available at http://dl.dropbox.com/u/20060733/picketlink-reg.war
My standalone.xml is at Link.  You will need to change the client id and client secret.

This article is also available at DZone. Link is http://server.dzone.com/articles/jbossas7-making-your-web

Troubleshooting

• In the Facebook Developer console where your app settings exist,  Edit Settings ->WebSite >
  • Site URL:  Specify the url of your web application.
  • Site Domain:  domain of your web application. (If testing locally, you can specify localhost)

Facebook over SSL only

If you use Facebook for your social networking needs, then do not forget to perform the following step to ensure FB is accessed over https/ssl only.

Go to:
Account -> Account Settings -> Account Security

Click "Change"
Check the "Browse Facebook on a secure connection (https) whenever possible" under "Secure Browsing (https)" section.

Click "Save"

Social Media increases our connection to the Internet

Most of us use Social Media in one form or the other. Be it Twitter, Facebook, LinkedIn, Four Square, blogger etc. It is a means by which we stay connected to this planet. Your old friend lives thousands of miles away on the other side of the planet, well, you can reach out to him on a daily basis via the social media. You have not met this classmate since kindergarten and now you get connected to him by Facebook or Myspace.

Each time you use social media, you are giving out your privacy, a bit at a time. I am sure one day avid users of the Social media can attest to Scott McNealy's famous saying on privacy. Before getting there, let us look at one phenomenon of human relationships that is getting to be the toughest for individuals - young and older. The social phenomenon of breakups. Breakups are normal psychological phases that individuals go through, in this world.

Scott Bolohan of Chicago's Red Eye has this interesting article on how the Internet is making it harder for him to breakup. I know. I know. The article is funny (at least all that Scott does to trace his old flame). But a deeper introspection of what Scott is trying to communicate will make you understand the grand scheme of things associated with social media.

Since it is a small world and we are connected to one another via mutual friends, it is going to be increasingly difficult not only to breakup but also to find suitable dates. Gena Grish talks about it in the Huffington Post. She has trouble with potential dates googling about her.

What are the alternatives? Stop using the social media? Do not divulge any information on the web? The jury is out. We certainly are entering or entered a Brave New World. Either we embrace it or live in our own shell.

Facebook and Corporate Users

In the latest debacle associated with the usage of Facebook, 13 employees (Crew) of Virgin Atlantic have been sacked for inappropriate discussions on facebook which has brought disrepute to the employer.

http://news.bbc.co.uk/2/hi/uk_news/7703129.stm

"Following a thorough investigation, it was found that all 13 staff participated in a discussion on the networking site Facebook, which brought the company into disrepute and insulted some of our passengers.

"It is impossible for these cabin crew members to uphold [our] high standards of customer service... if they hold these views."

A spokesman for the airline added that there was "a time and a place for Facebook".

Other aspects that you need to look at are the proliferation of viruses via the social networks - Facebook Koobface computer virus or Orkut scrap virus.

The biggest users of social networks are the Gen Y be it on personal, mobile or corporate set ups. A disturbing report on Information Week.

"Since Nov. 5, three separate studies -- from Accenture, Intel, and ISACA, a major IT users group -- have indicted the youngest generation of employees as one of the enterprise's newest and most serious security risks. People under the age of 28 -- sometimes called Generation Y and sometimes called Millennials, depending on how you define the category -- are engaging in online behavior that could expose their organizations to data leakage and information theft, the studies say."

"Interestingly, the Intel study suggests that many IT organizations are changing their behavior to accommodate the younger employees, rather than the other way around. Nearly 30% of the IT pros surveyed said they have changed their IT policies to meet the demands of Gen Y, allowing employees to access their work e-mail from noncompany smartphones or other devices and, in some cases, relaxing their rules surrounding the use of social networking sites."

Read >>>

Why does Facebook want my Date of Birth?

This is a common problem with all internet websites. They want to know my date of birth. Because they want to ensure that either I am above 18 years old or that I need to be wished by other folks on my birthday.

How can I be sure that their database is not compromised? Just because I get a lengthy privacy safeguard letter or url from facebook, orkut and other websites, it does not mean that I can feel SAFE.

Look at a detailed look at psychological, social and privacy related issues with Online Social Networking sites at my blog entry.

Basically, what Facebook is trying to do is comply with COPPA (Children's Online Privacy Protection Act) to try and find if you are above the age of 13 years of age and in addition tell your friends about your birthday. By default, the birthday is public in your profile (which is another screwed up default).

I think the following would have sufficed and been better:
a) "Is your age 13 years or above?"
b) Please give us your date and month of birth.

DO NOT FORGET TO TURN OFF DATE OF BIRTH VISIBILITY IN YOUR PROFILE.

Dangers of Facebook in a corporate environment: http://anil-identity.blogspot.com/2008/11/facebook-and-corporate-users.html