Growing need for Social Intelligence

In the past, there were firewalls, employee agreements and corporate training to inculcate proper corporate etiquette in employees. As an employee, you were told that

• when you are in public, then sensitive corporate information was not to be uttered.
• when you were sending an email outside the organization, your language/tone had to be watched.

Companies needed to maintain vigil and dilgence to safeguard their secrets, brand and Intellectual Property. Ok, that was the 90s.

Then came the world of blogging. Wikipedia became the de-facto encyclopaedia of the world. Then came LinkedIn, Twitter, Facebook, Foursquare and your-favorite-social-network-or-location-or-web2.0-application came into existence and started getting popular. Of course, I did not forget Pinterest and Instagram.  The iPhone revolutionized mobility. Who has not clicked a picture of a place or product or something and published on twitter/facebook?  Instagram makes that easy.

This is the 21st century I am referring to.  Companies started to get involved in social media to maintain brand recognition, marketing and customer outreach.Nothing wrong with that.  Many companies encouraged their employees to embrace openness and use social media.

Things seem to be going well for everybody. I am sure we will see some employee crossing the line and mistakenly sharing private confidential information on the internet. Remember congressman Anthony Weiner 's episode of forgetting to use "D" at the beginning of his tweet. Rather than the tweet going as a direct message to one of the twitterers, it got shared with the world. The rest is history.

Reading Network World's latest bit on security and social media, I strongly feel that there is a need for Social Intelligence.  Rather than people monitoring the social media to see if private information is getting divulged, we need intelligent software that can monitor the social world to flag rumours and threats to corporate brand.  I believe many a times, employees step the thin line. not because they want to harm their employer, but because they do not know where the line starts and where it ends.

Let there be Social Intelligence not to monger fear but as a valuable tool in safeguarding corporate brands and IP. Companies should not take the knee-jerk policy of banning social media from the enterprise. What you end up doing is lowering your employee morale, in this brave new world. Just manage your brand better via social intelligence.

JBoss AS 7:: Social Login (Facebook Connect/ Google Authentication)

Background

There is no denying that Social Media is growing leaps and bounds. The concept of social login has prevailed.  Facebook and Google have turned out to the holders of user information that can be used to be the secure gateway into your web applications. Facebook / Google Users are part of what is called "Consumer Identity".
In this article, we will look at a simple web application as part of the PicketLink Social Project, that can help you visualize addition of Facebook Connect / Google Authentication to your web applications.  We will use the fast, free and awesome JBoss Application Server v7 as the runtime.

What is needed?

You will need to get hold of

• JBoss Application Server v7.1 (at the time of writing, v7.1.1.Final was the latest). 
• Use the self contained picketlink-reg.war.

Steps to follow

1. Follow the JBoss AS7 user guide to extract the server.  It is mainly just unzipping a zip archive.
2. Now copy the attached picketlink-reg.war to standalone/deployments directory of JBoss AS7.
3. You need to make some configuration changes to standalone/configuration/standalone.xml file to add a security domain as well as a bunch of system properties.
4. Start JBossAS7 in the standalone mode. 
5. Test the Web Application.

Configuration Changes to be made in standalone.xml

TIP:  I do attach my "standalone.xml" to this LINK.

 Define a security domain called "external_auth"

<subsystem xmlns="urn:jboss:domain:security:1.1">

<security-domains>

<security-domain name="external_auth" cache-type="default">

<authentication>

<login-module code="org.picketlink.social.auth.ExternalAuthLoginModule" flag="required"/>

authentication>

security-domain>

<security-domain name="other" cache-type="default">

 What Ihave done is inserted a block of security domain configuration inside the security configuration and before the security domain "other".

Define a bunch of system properties.

extensions>

<system-properties>

<property name="CLIENT_ID" value="Insert_your_client_id"/>

<property name="CLIENT_SECRET" value="Insert_your_client_secret"/>

system-properties>

<management>

<security-realms>

We have defined a block for system properties at the end of the block for extensions and the beginning of management.  Please have a look at the wiki article on JBoss AS7 System Properties, for more information.

Note that I am assuming that your app is deployed on localhost.  If the domain is different, then you have to define an additional system property called "RETURN_URL" that gives a value such as "http://thedomain/picketlink-reg/auth"  (replace thedomain with whatever value you want).

How to test the web application?

You can go to http://localhost:8080/picketlink-reg/
Now you can login either using Facebook Connect or Google Authentication.
Note that the attached web application just outputs the name of the authenticated user and the email address.  You can get more information if desired by changing the configuration settings.

What changes do we need to make a web application use Facebook Connect or Google Authentication as its Authentication Mechanism?

You will need to configure the ExternalAuthenticator in WEB-INF/jboss-web.xml   Look at how the attached picketlink-reg.war application does it.


Reference
https://issues.jboss.org/browse/PLFED-272

Attachments

picketlink-reg.war is available at http://dl.dropbox.com/u/20060733/picketlink-reg.war
My standalone.xml is at Link.  You will need to change the client id and client secret.

This article is also available at DZone. Link is http://server.dzone.com/articles/jbossas7-making-your-web

Troubleshooting

• In the Facebook Developer console where your app settings exist,  Edit Settings ->WebSite >
  • Site URL:  Specify the url of your web application.
  • Site Domain:  domain of your web application. (If testing locally, you can specify localhost)

Security issues surrounding Social Networks

Social Networks carry a lot of private information about people. This can be advantageous as well as disastrous to individuals.

Giles Hogben of ENISA has been doing a lot of research work on security issues surrounding social networks. A position paper from Giles titled "Security issues in the future of social networking", has been presented at the W3C workshop on the Future of Social Networks.

Interesting bit from Giles's paper:

The biggest repository of personal images on the internet is not Flickr but Facebook (already with a staggering 30 billion images, while 14 million new images are uploaded every day). The largest number of personal profiles on the planet is held not in a government identity registry (at least not one we know about...) or one of the much heralded Federated Identity Providers but in the data warehouses of the Social Networking providers.

Why does Facebook want my Date of Birth?

This is a common problem with all internet websites. They want to know my date of birth. Because they want to ensure that either I am above 18 years old or that I need to be wished by other folks on my birthday.

How can I be sure that their database is not compromised? Just because I get a lengthy privacy safeguard letter or url from facebook, orkut and other websites, it does not mean that I can feel SAFE.

Look at a detailed look at psychological, social and privacy related issues with Online Social Networking sites at my blog entry.

Basically, what Facebook is trying to do is comply with COPPA (Children's Online Privacy Protection Act) to try and find if you are above the age of 13 years of age and in addition tell your friends about your birthday. By default, the birthday is public in your profile (which is another screwed up default).

I think the following would have sufficed and been better:
a) "Is your age 13 years or above?"
b) Please give us your date and month of birth.

DO NOT FORGET TO TURN OFF DATE OF BIRTH VISIBILITY IN YOUR PROFILE.

Dangers of Facebook in a corporate environment: http://anil-identity.blogspot.com/2008/11/facebook-and-corporate-users.html