Philosophy is fuzzy, but AuthFW's primal philosophy is clear: the user is in control.

The design of AuthFW started with the principle that the framework has nothing to hide, unless you are not authorized for it. From this point on, the challenge is about the creation of an infrastructure where everything is transparent but also functional and secure.

Design considerations

When you implement a service that involves storing personal information, responsibility is on top of the priority list. AuthFW is built around the concept that the user, and nobody else, is in control of its own information. This creates a freedom, but also a responsibility towards the user. The system has to provide all means necessary to facilitate in realizing this principle by offering the services a user needs to maintain its information, designing the protocols from the user perspective and securing the information so the user has access to its profile at all times. The freedom and responsibility dilemma can only exist when they are balanced in the right way. In the case of AuthFW the balance is defined by: AuthFW takes the lead, and the user can always take back control.

This implies another important rule in the design of AuthFW: technology exists to serve people. This means that if you want to get somewhere using technology, you don't really care how it works, as long as it works. But if you, as a user, want to gain control over some process or setting to adjust the system for your own use, that freedom must be there for the user. The rule of usability.

Other foundations of AuthFW are that is must be reliable, meaning stable and trusted. Since neither of these demands can be toggled or implemented in code, it must be in the design of the system as a whole, and the system must prove itself to be stable and reliable. We trust it to be stable and reliable, but time will tell whether we are right.

And of course, designed by a company with its heart in technology, AuthFW had to be scalable into all directions:

• Core applications

• Network services

• Protocols

• Performance