Microsoft revives TrustBridge for Web services role

Microsoft is dusting off its year-old and mostly forgotten TrustBridge technology and recasting it as middleware to support federation of identities across disparate platforms, company officials said Wednesday.

SAN FRANCISCO – Microsoft is dusting off its year-old and mostly forgotten TrustBridge technology and recasting it as middleware to support federation of identities across disparate platforms, company officials said Wednesday.

Microsoft said at the annual Burton Group Catalyst Conference that TrustBridge will become a security server capable of producing a user authentication and authorization token in a variety of formats. It will also facilitate the sharing of that token across corporate boundaries.

The server is a key part of Microsoft’s effort to create an identity management framework that will work across disparate platforms. Just last week, the company unveiled its retooled meta-directory server, Microsoft Identity Integration Server, and released its Active Directory/Application Mode directory as part of its push into the identity management market.

“We are trying to simplify federated identity management, integrate identity infrastructures and provide a security infrastructure to support Web services applications,” says Michael Stephenson, lead product manager for Windows Server.

Despite Microsoft’s newfound exuberance toward federated identity, it is still mum on how it might integrate with the Liberty Alliance, a group that is creating a framework for federated identity management.

“We continue to have a good relationship with Liberty, and we continue to work on an interoperability solution,” says Stephenson.

Microsoft plans to release TrustBridge around the time it ships the Longhorn version of the Windows operating system in 2005 or 2006. TrustBridge will require software on both the server and client side that supports WS-Security, an emerging Web services security protocol.

Microsoft officials still would not confirm reports that they will have a server version of Longhorn. The company also would not say how TrustBridge would be packaged and licensed.

TrustBridge was introduced more than a year ago as a bridge for sharing Kerberos authentication tickets among business partners. At the time, critics said the scope was too narrow, in that users had to have TrustBridge set up on both sides of the transaction and were required to use Kerberos.

Microsoft said it has gone back to the drawing board with the advent of WS-Security and a number of supporting security protocols Microsoft has developed in conjunction with IBM, including WS-Policy and WS-Federation, which was announced this week.

“TrustBridge is how we will build the set of WS-Security protocols into the Windows platform,” says Doug Bayer, director of Windows security for Microsoft. “The WS-Security protocols gives us a much more general-purpose infrastructure.”

The revamped TrustBridge will be able to generate security tokens in a variety of formats, including X.509 certificates, Kerberos, the Security Assertion Markup Language and the Extensible Rights Management Language.

TrustBridge also would be used to store and manage a set of policies that dictate the types of information and formats needed to build a security credential that is acceptable on a particular partner’s identity infrastructure. For instance, the token could identify the bearer as a corporate procurement manager with a purchasing power of $100,000. TrustBridge would look at the policies when a user requested access to a partner’s system and format on-the-fly a security token the user would present to access the partner’s applications and data.

Partners that share identities across corporate boundaries will not be required to have TrustBridge on both ends of the transaction.

“It could be WebSphere and Tivoli on the other side, or any product that supports WS-Security,” says Stephenson. “We will enable customers to take existing applications and new Web services applications and integrate identity among those applications both internally and externally.”

Another change in TrustBridge is the elimination of a proprietary technology Microsoft created to allow a message based on Simple Object Access Protocol (SOAP) to carry a security token in its header. The proprietary technology is being replaced by WS-Security, which allows security information to be attached to SOAP headers.

Microsoft plans to integrate TrustBridge with its existing Authorization Manager, a role-based authorization service that is part of Windows Server 2003 and defines usage rights based on attributes such as job title.

It also will release version 2.0 of its Web Services Extension toolkit in the near future to help corporate users build support for the family of WS-Security specifications into applications. None of the five existing specifications have been submitted to a standards process except for WS-Security, which was accepted by the Organization for the Advancement of Structured Information Standards in September 2002.