As an analyst, I often feel most validated when groups on both sides of an issue are equally upset about a presentation I’ve given. When in the past both Microsoft and Liberty Alliance complained about my positions on federated identity, I’ve taken the crossfire as proof that my point of view was balanced.
This year, however, Microsoft liked my presentation at Burton Group’s Catalyst Conference, and Liberty Alliance seemed happy enough, as well. All the positive feedback had me wondering: What gives?
Something has changed for the better in the industry. In my speech I said, “The glass of identity interoperability is three-quarters full.” Last year, a similar slide read “half full.”
The difference today is that the interoperability of vendor products has exceeded anyone’s expectations. This spring, when planning a multi-vendor and multi-protocol federation demo for Catalyst, I thought we would be lucky to find a few vendors with multi-protocol hubs to coordinate.
But in the actual demo, 14 identity-management vendors interoperated through multi-protocol hubs; translation and hybrid scenarios involved browsers and Web services. They simulated an “automotive value chain,” where dealers and manufacturers use different federation protocols, showing interoperability between Liberty Alliance, Shibboleth, multiple versions of Security Assertion Markup Language (SAML ), WS-Federation Passive Profile, WS-Security and the WS-Trust specification, which defines a Security Token Service. The last three are part of the WS family of protocols Microsoft and IBM are developing.
In addition, Microsoft, IBM and partners announced their commitment to contribute WS-Trust, WS-SecurityPolicy and WS-SecureConversation to the Organization for the Advancement of Structured Information Standards (OASIS ) in September. This long-awaited move and the successful interoperability demo signify that, for the most part, vendors have moved past arguing about the standards and on to implementing them.
With the standards wars winding down at last, some loose ends remain. Microsoft should still develop full OASIS SAML browser profile support. Liberty Alliance should begin converging some of its advanced work with the WS specifications now going to OASIS. WS-Policy and other specifications from Microsoft and IBM’s vendor group should also go to OASIS or another standards body soon.
However, technical interoperability is only half the battle. Business interoperability – establishing relationships of trust between disparate business units or business partners – is the bigger problem. Companies still lack standards for business rules, and audit and accreditation mechanisms.
Still, customers should be encouraged by the improved technical interoperability climate. Include federated identity in the enterprise identity-management architecture and consider how to leverage it to solve identity problems today. Specify SAML 2.0 for browser federation needs and WS-Security for Web services security. Consider WS-Trust security token services for more complex interoperability scenarios.
When running a federation project, users (unlike analysts) don’t want to get caught in the crossfire. Keep the trust fabric simple, working with current partners first and turning to industry trust frameworks (such as the Federal E-Authentication Initiative) for broader deployments. Perform risk analysis, protect user privacy and involve stakeholders, such as application owners and general counsel, early in the process.
Blum is senior vice president and research director with Burton Group, an integrated research, consulting and advisory service. He can be reached at danjblum@yahoo.com.
