SAML gains steam

An XML protocol that appears on its way to becoming a key building block for standards-based security picked up momentum last week as vendors introduced products and vowed to provide free access to their patents to advance the cause.

The efforts are in support of the Security Assertions Markup Language (SAML), a framework for exchanging authentication and authorization credentials over the Web, which promises to give IT executives a way to tie together disparate security systems internally and with business partners.

Last week, RSA Security announced that it would offer royalty-free use of two patents it owns that are similar to how SAML functions, therefore quashing concerns that the patents may hamper the acceptance of SAML.

Also, Quadrasis, a business unit of Hitachi, introduced a developer tool for building SAML support into connectors that work with its Security Unifier. The product is similar to enterprise application integration software in that it provides a routing and transformation hub and a set of connectors that allow disparate security systems such as authentication systems, single sign-on software and encryption products to work together.

Security Unifier runs on Solaris and Windows NT/2000. The base configuration costs $100,000.

"It is still early in the development of SAML," says Randy Heffner, a vice president at Giga Information Group. "But support is on the move. We have more and more vendors supporting SAML and that adds weight to the effort."

SAML is gaining steam as it moves through the standards track at the Organization for the Advancement of Structured Information Standards. Ratification is expected in June. Experts say SAML will make it easier for users to cross security boundaries, especially those between companies that have established trust relationships. Combined with another emerging standard for digital signatures called XML Signatures, companies can exchange signed SAML assertions that confirm a particular user is authenticated and authorized to access certain network services.

RSA, which is building SAML into its Web Access Management product called ClearTrust, is offering royalty-free access to U.S. patents that cover one type of SAML assertion called Browser/Post Profile, which basically delivers a digitally signed SAML assertion through an HTML form stored on a browser. Most vendors today, however, are implementing a simpler type of SAML assertion called Browser/Artifact Profile.