More Security for Web Service at UIC: Bluestem and Ness

On a campus like UIC - or a group of campuses like the University of Illinois - the authentication question is a bit different. There are Web services that you're entitled to use just because you belong at UIC and others that you can use because you belong to the U of I. (Some of the services of the UIC Library, for example, and the online Oxford English Dictionary at UIUC.) So the question is how do you prove to these servers - particularly those on another U of I campus - that you're worthy?

The answer is not to give your netid and ADN password to them as proof of your identity. Even when you're using SSL, it's not a good idea to give out your password to anyone, server or human, unless you know exactly how they will use it and how safe they will keep it. Nor is the answer to have a separate ID and password for each service. That's quite cumbersome, and who could remember all those account ids and passwords anyway?

The Computer Center runs a Bluestem secure ID server for UIC, ness.uic.edu. (That's "ness" as in Elliot Ness, the FBI agent.) We will concentrate on making ness secure, so you can keep your password secure. Someday soon (if not already), you'll be able to use ness to access online services such as Grateful Med, from anywhere, without having a separate account for it or having to worry whether someone will snatch your password in the process.

Return to Contents.

1. You request service from a given URL.
2. You receive a reply back from ness.uic.edu asking you for your netid and password, which you enter and ness processes. (See Figure 1.)
3. The original server replies to your request.

Ness's asking you for your netid and password is its assurance to you that the server you've contacted is legitimate. Ness's sending you back to the server with your credentials and your netid is its assurance to the server that you are legitimate.

What really happens is a bit more complicated:

1. You request service from a given URL. That URL's Web server receives your request and redirects your browser to ness.uic.edu, UIC's Bluestem Web server, asking it to verify your identity. ("Redirection" means that you request service from one URL but you receive a reply back from a different URL.)
2. Using SSL encryption, ness asks you for your netid and password. You send them and ness receives and verifies them. Then, again using SSL, ness sends your netid to the original Web server with its OK.
3. Continuing to use SSL encryption, the original server replies to your original request, having been satisfied by its conversation with ness that you are who you say you are: the person with your netid.

Return to Contents.

Logging into ness is quite easy. When ness asks you for your netid, type it in the box provided and press Enter. (Include your domain - @uic.edu - if the Bluestem login screen you get isn't from ness; for more information, see "Domains and Auth Methods in Bluestem".) Then ness will ask for your password; it will accept your tigger, icarus, or UICVM password. If your netid and password match, ness will send you to the original Web server with its blessing. If not, ness will allow you to restart the login process.

Netscape:

The key in the bottom left corner of the Netscape window is unbroken and there's a narrow blue line across the top of the display area, below the URL.

Microsoft Internet Explorer:

A yellow padlock appears in the bottom right corner of the IE window.

Never send your ADN password over the Web unless the request for it comes from ness.uic.edu and you see the blue line and unbroken key (in Netscape) or the padlock (in Internet Explorer). 

Figure 1a: SSL Security and the Bluestem Login Process The figure below is the ness Bluestem login screen in Netscape:

Figure 1a: SSL Security and the Bluestem Login Process And this is the ness Bluestem password screen in Microsoft Internet Explorer:

All in all, Bluestem provides a simple and easy way to get your applications and keep your password too!

Comments are welcome; send them to:
Bog Goldstein, bobg@uic.edu