1. What exactly is Identity Federation?
These days, most websites and mobile apps don’t know how to authenticate you.
Instead, they call the APIs of services offered by popular “Identity Providers” or “IDPs”,
like Google and Face book.
This enables a person’s “user” information to be utilized at many different websites on
the Internet, and information about a person can be shared with websites and apps on
an “as needed” basis. Of course web site developers don’t want to learn a different
authentication API for each IDP. And many organizations don’t trust a third party to
authenticate its people. So the Internet has moved to standards. The most widely used
standard for Web authentication is SAML. Perhaps the most promising standard for
sso authentication is OpenID Connect, which is a profile of OAuth2.
The explosion of Two-Factor Authentication technology…
One of the most important new technologies that are driving infrastructure changes is
the explosion of strong factor authentication technology. There is a triangle of
authentication consisting of price, usability and security. Not all triangles are equal.
New technologies are arising that are more convenient, more secure and less expensive
than passwords.
2. Once a company makes an investment in strong authentication, they want to use that
authentication technology across the maximum number of apps. For this reason, it
makes sense to support open standards, so all applications can benefit from the
availability of these new organizational authentication capabilities.
The Problem of Client Management
It’s not only people that need to be authenticated and authorized. There is a proliferation
of agents that act on behalf of the person, or are independent entities. How are these
authenticated and authorized by the organization…?
Seismic Shift: LDAP or WAM?
I think the seismic shift is from WAM (web access management) –> Federation, not from
LDAP –> Federation. LDAP is still entrenched as a robust persistence infrastructure for
user claims and password credentials. The problem with WAM products (i.e. Site minder,
OAM, TAM…) is that the cost has been high, customers are locked in (why else did CA
buy Integrity…), and integrations have been slow.
Companies realize that whether they are integrating authentication with internal apps,
external apps, or off-the-shelf products, open federation standards enable consolidation,
which saves money, and improves security.
3. In the large companies I’ve worked with, the security department did not have control
over the applications, so even though they were “internal”, a top-down approach was
inefficient. It’s better to publish your standards, and let the internal app developers
“help themselves” than to push a WAM architecture on them. In this sense, the fact
that there are external apps just provides further evidence to a trend that had already
clearly emerged.
IAM, not IDM
Often times, clients and consultants put too much emphasis on IDM, and not enough
emphasis on organizational trust management. It’s not just that I need to provision
my users for external websites, but I need to understand with which websites I have
shared which attributes. Also, organizations need to trust users who authenticated
outside the organization. Most large organizations participate in an ecosystem of
autonomous parties, and publish websites that are used by many outside the
organization. This is the old problem of extranet user management. Trust
management, IMHO, is one of the biggest challenges…
Where does XACML fit?
If you talk to organizations, you’ll find that the is no clear trend for XACML’s adoption.
Proprietary and custom solutions are the rule in authorization right now, with most
authorization actually taking place in the app.
4. To what extent centralized authorization will be achieved is totally uncertain, and I
would argue that this is the “adjacent possible,” as described in Stephen Johnson’s book
“Where Good Ideas Come From” — you can’t have authorization before we have clear
standards for authentication. In terms of adoption of technology, I’m bullish about
UMA, and in fact I think UMA and XACML are complimentary… app developers want
JSON/REST… and it would be more suitable for the PDP to form a XACML request to a
XACML PDP, then for the app developer to learn XACML. In any case, I’m a fan of
XACML as a standard for expressing authorization rules, but I do think that the
technology is better suited for server side developers.
Who will Outsource IDaaS?
I disagree with the common assumption that the majority of “IDaaS” will be outsourced.
Perhaps for SMB market, this might be true. But many large organizations maintain
core TCP/IP services, and AAA has traditionally been managed within the
organizational perimeter. In fact, many organizations simply cannot outsource this
function for security reasons. With standards, we will drive down the costs of the wam
software and the resources, and AAA will be simply another Linux or windows service
that can be configured.
Article resource: http://thegluuserver.livejournal.com/4561.html