On Mozilla’s identity and access management (IAM) initiatives

(Cross-post from Mozilla’s discourse.)

Introduction

This document describes some of Mozilla’s activities in response to the decommissioning of Persona. It describes the change taking place in many of our web properties. Additionally the document provides a short overview on Mozilla’s broader identity and access management (IAM) initiatives.

Summary (TL;DR)

  • Persona will be decommissioned on NOV 30, 2016.
  • Our new authentication provider is built with Auth0 at its core.
  • All Participation Systems properties (reps.mozilla.org, mozillians.org, moderator.mozilla.org and others) will be using Auth0 moving forward.
  • Using this new authentication provider, Mozilla will transition many of its web properties that use Persona today to provide both
    • password-less email login for all profiles on Mozillians.org and
    • LDAP login for staff.
    • Additionally, some web properties will offer select social logins (e.g. Google, GitHub).
  • Moving into 2017, Mozillians.org will be fully integrated with Mozilla’s LDAP. This will enable volunteers and paid staff to collaborate using some of the same platforms and tools.

Persona Replacement (aka IAM Package B)

As previously mentioned on mozilla.dev.identity [Jan 12 2016 and Oct 13 2016], Persona is slated for decommissioning on November 30th, 2016.

Mozilla will not offer a public-facing authentication service like Persona after November 30th. Information for website owners to migrate their sites away from persona.org can be found on the wiki.

Many of Mozilla’s web properties (some of them listed below) will replace Persona with a new authentication provider based on Auth0. This means that Mozillians will be able to authenticate on many Mozilla sites using password-less email login, or select social logins (e.g. Google, GitHub). Staff members can continue to use their LDAP credentials on these sites. This transition includes, but is not limited to: Mozillians.org, Discourse, Moderator, Reps Portal, and Air Mozilla.

For the web properties maintained by the Participation Systems team (Discourse, Moderator, Mozillians.org, Reps Portal) this bucket of work is often referred to as “IAM Package B” and can be tracked on the team’s Kanban board. Package A was a technical proof of concept which successfully ended in September 2016.

Mozillians.org LDAP Integration (aka IAM Package C)

Looking towards 2017 we plan to integrate Mozillians.org with LDAP, to facilitate group management and access control for both paid staff and volunteers. This endeavor is often referred to as “IAM Package C”. Connecting these two systems will allow us to offer a single access management system for all Mozillians, volunteers as well as paid staff. We are still designing this new system and will share additional details in the coming months.

This groundwork will eventually allow us to differentiate collaboration tools’ access levels based on project needs instead of employment status. Think about the ability to provide document access to a hybrid project group of volunteer and staff contributors. This is a natural next step in our work as a radically participatory organization.

Feedback welcome!

This article hopefully provided insight into Mozilla’s currently running and planned activities around identity and access management. We invite you to continue the conversation at this discourse post.

Back at the Front at #push16

During the last two days Mozilla had a booth at push.conference 2016 in Munich. Push unites creative coding and user experience design, by offering a platform for designers, developers and UX professionals.

Elio, George and I represented Mozilla. To put it in George’s words:

Among the things we presented to booth visitors were:

Here’s what I learned this week:

  • Be there, talk and -most importantly- listen to people. It’s exhaustive and rewarding. Totally awesome.
  • On the Innovation Toolkit:
    • The toolkit allows us to open a conversation with a whole range of new (potential) contributors: experience designers, visual designers, and many other creative types.
    • We are missing a creative commons content license. This is a bug and will hopefully be fixed soon.
    • People have not heard of the toolkit yet. We need to be louder about it.
    • Students and higher-education teachers are really interested in this.
    • Seasoned professionals identified it as a great “quick reference” source.
    • We need to become better at explaining WHY Mozilla has created this innovation toolkit and WHAT’s the Mozilla’iary aspect of the toolkit and HOW it is used inside and outside Mozilla.
  • On the EU Copyright Campaign: People like it. Many can’t believe how broken current copyright rules are.
  • On the Equal Rating innovation challenge: Again, people really like the idea. Students and university teaching staff are very receptive on potentially running creative projects around that topic.
  • On the Mozilla Festival: It would be great to get the word out to more designers and UX professionals to join us at #MozFest.

Overall, a great couple of days.

Update: Elio’s post has some additional details on #push16 itself.

Overwhelming Response

This is the end of week 1 as Mozilla employee. Here’s What I learned This Week …

An Overwhelmingly Positive Response by Mozilla Reps

Before joining Mozilla, I sent a message to all Mozilla Reps asking for their opinion on my role in this hybrid volunteer-and-staff-driven community empowerment program:

Dear Reps,
Dear Mentees,
Dear Council,
Fellow Peers,

on Monday 05 Sept, 2016 I will become a Mozilla employee. Following almost 15 years as a volunteer Mozillian I was offered the opportunity to take this new perspective on the Mozilla Project. My job title is Participation Strategist and I am part of the Participation team reporting to George.

At this moment I hold various roles in the Reps Program:
– Rep
– Mentor
– Module Peer

In my role as a Reps Peer, I have aimed to serve the ReMo program by setting direction and execution on strategic questions.

Moving forward, I’d like to continue contributing to ReMo. I anticipate that my actions will be influenced by the fact that I am a staff Mozillian. Of course I hope that this “bias” will be positive for Reps. At the same time I accept that people are sceptic of too much employee involvement in the program.

For this reason I put my roles in the ReMo program at your disposition. If anybody wants to veto against me being in any or all of the above mentioned three roles, please send a message to our Module Owner Ioana (in CC) and she will take the necessary action ensuring your privacy.

Let’s keep rocking the Open Web.

Always at your service,
Henrik
Mozilla Rep, Mentor, Peer and soon employee

The answers blew me away. There were responses from many parts of the world congratulating me on becoming Mozilla staff. A huge thank you to the Reps from Uganda, Germany, Bangladesh, Taiwan, Malaysia, India, Hong Kong, Mauritius, Ivory Coast, US, Venezuela, Belgium, Tunisia, France, Italy and many others.

An Overwhelming Positive Response on Social Media

Also, as soon as I tweeted and posted a Facebook update, lots of positive feedback arrived.

To all of you who thought of me and dropped me a line: Thank you! I am blessed to be serving our mission to ensure the Internet is a global public resource, open and accessible to all.

Joining Mozilla as Participation Strategist

Today I am joining Mozilla as Participation Strategist. Following almost 15 years as a volunteer Mozillian I become a staff contributor.

This is an immense honor and I can only pledge to serve Mozilla’s mission, ensuring the Internet is a global public resource, open and accessible to all. An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent.

Over the coming months I look forward to working with the Participation Systems team on Mozilla’s Identity and Access Management agenda as well as deepening our research on Volunteer Management Systems.

Onwards, lot’s of learning ahead!

Growing up from henx to hmitsch

I have been known as henx for quite a while. This was my teenage nickname and so it became my first Unix account and email address (henx@wst.edvz.sbg.ac.at) in 1995.

Upon joining Twitter in March 2011, I became hmitsch.

Over the past few weeks I have renamed a lot of my online profiles from henx to hmitsch. This is the slow end for a long-time online ID. It’s probably time for that change.