Competition has its place – on the playing field or in the boardroom – but when it comes to standards and specifications (such as those for identity management), we’d all do well to adopt a more cooperative attitude.
Everything these days appears to be a competition. Not only in sports (Red Sox vs. Yankees, Manchester United vs. Barcelona and so on) but in politics (California Gov. Gray Davis vs. 200-plus people who want to replace him), and even high-tech business (PeopleSoft’s Craig Conway vs. Oracle’s Larry Ellison). We’re so attuned to competition that we see it where none exists.
The other day I was speaking with Phaos Technology CEO Roger Sullivan, catching up on the company’s tool kits that support the Liberty Alliance identity-federation specification. I asked him about Liberty’s spec vs. the recently introduced WS-Federation specification (part of a series of Web Services specifications IBM and Microsoft are launching in a bid to control the next stage of computing). After first giving me the obligatory support speech (“Phaos, as a technology provider, will support all protocols our clients want to support”), Sullivan said the two offerings are not that competitive and that it’s quite possible to support one with the other.
WS-Federation, as befits a specification from two high-profile tech leaders, is heavy on the technology of federation but completely ignores the business case. The Liberty Alliance, on the other hand, originally articulated a strong business case with a lot of “we’ll fill in the blanks later” about the technology. For example, Liberty only specifies the Security Assertion Markup Language (SAML) as its transport mechanism. On the other hand, WS-Fed supports SAML, Kerberos, x.509 certificates and Extensible Rights Markup Language – and it easily can be extended to other methods.
But WS-Federation has nothing to say about the agreements, trust and liability that federation brings to the various parties in a transaction, while the Liberty Alliance (consisting mostly of organizations in the business-to-consumer and business-to-business space) has a series of well-thought-out scenarios and recommendations for the business agreements that are a necessary part of identity federation.
Sullivan says he believes that eventually a combination of the two specifications might be what succeeds in the real world. There’s certainly nothing in the Liberty specification that would disallow following WS-Federation in terms of transport and security mechanisms while relying on the business “best practices” ideas in the alliance’s specifications.
Competition has its place – on the playing field or in the boardroom – but when it comes to standards and specifications, we’d all do well to adopt a more cooperative attitude.
Tip of the week
The U.S. and many European governments also soon will be embedding machine-readable tags – these containing biometric descriptions. New U.S. laws require machine-readable passports with biometric data to more readily identify people entering the country. Get more details.
