All Contents © 2008 Burton Group. All rights reserved. Current State of Federated Identity OASIS Open Standards Forum 2008 Friday, 3 October 2008 Gerry Gebel VP & Service Director – IdPS–

A Few Points to Ponder State of federation is strong – but the game is changing Business models are driving up demand for federation technology – and forcing still other changes Federation and SSO services – an emerging trend to watch 2

After this presentation, you will… … stop federating Because business people don’t know what you are talking about 3 … realize that protocols do not equal a business process You need services and capabilities, in addition to protocols and technologies … discover that the Internet doesn’t need an identity layer Rather, it needs a relationship layer!

Business Trends Drive IT Trends Same as it ever was Global economy, cost-effective communications driving fundamental change to the business environment The more global things get, the more pressure to decompose big orgs Need to integrate business process across many boundaries Must interoperate, connect with security and low friction 4

Business Trends Drive IT Trends What a difference a year (and a financial crisis) makes Do more with less, or do less with less Plate tectonics: Business transformation, IT transformation collide SaaS gaining favor... the times they are a-changing Outsource, offshore, buy it as a service 5

Current Technologies and Methodologies The Expanding Identity Universe Dynamics are driving requirements where CIOs have no control 6 Scale Control Focus Small Large Massive Centralized Distributed BusinessIndividual SMB, SaaS Consumers, Social Networks Deperimeterization Outsourcing Compliance Privacy The CIO and the budget

Where does federation fit in here? 7

8 Federation and Distributed Control

Examine the Problem SSO: internal applications 9 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Employees Contractors Partners

Examine the Problem SSO: hosted applications 10 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Employees Contractors Partners WAM/Federation ? ?

Examine the Problem SSO: external users 11 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Contractors Partners AD/Kerberos?

Examine the Problem SSO: external users 12 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Contractors Partners Federation?

Examine the Problem SSO: employee off site 13 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Employees Contractors Partners AD/Kerberos?

Examine the Problem SSO: employee off site, hosted applications 14 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Employees Contractors Partners Federation?

Examine the Problem SSO: new options 15 Employees SaaS Partner Applications AD/Kerberos WAM/Federation Employees Contractors Partners Federation service

Examine the Problem Why don’t we have SSO? Architecture limitations don’t accommodate new application types: Software as a Service Product and technology selection process failure Used RFP checklist instead of usage scenario analysis Vendor implementations limit your options Kerberos exhibits its weakness when external users are involved Microsoft Office products do not handle HTTP redirects New products or technologies may be required Hosted SSO/federation service is one possibility New approaches may be required Identity intermediaries can limit inherent friction 16

17 Enterprise AD forest LDAP directory services XML gateways Federation servers WAM servers Applications App servers Applications Partner sites ESSO SSL VPN Bulk feed Examine the Problem Maybe it is time to look at the business problem, instead of the technology possibilities

Too Much Science, Not Enough Art 18 The “science project”: connectivity is rarely straightforward Enterprise AD forest SAML assertion SAML-enabled proxy Federation product ADFS agent SharePoint 2003 Web SSO token LDAP directory ADFS Collaborator SID Attribute and group memberships Mapping info and claims WS-Federation Web SSO server Home authentication

19 Growth Rates for Federation Has anyone spotted the elephant in the federation room? All right, but what if deployment rate increases? Assume enterprises can deploy 500 connections per year One customer has 34,000 point-of-sale operations And that’s just for SSO No authorization Not hub-to-hub "How long has THAT been there?" > 1, connections / year = 42 years!! = 68 years!!

20 The Aesthetics of Ubiquity Your technology might be mediocre if: Adding a connection requires a project manager Adding a connection requires lab time Each connection requires a custom contract You have to coordinate your deployment with others The solution only works for the latest-and-greatest infrastructure Upgrading a server has ripple effects from end-to-end It seems reasonable to measure “connections per year”

21 What about that glass ceiling?

Interoperability 22 What if there was a similar program for XACML? Just asking…

Products BMC CA Entrust Evidian IBM Microsoft Novell Oracle Ping Identity RSA Siemens Sun Symlabs Edge Federation Cisco Forum Sys IBM Layer 7 Vordel Fed Services Covisint FuGen Solutions Symplified TriCipher EduServ Federation Marketplace

Open Source Options 24

Working on that scalability problem… 25

Expanding Federations 26

Federating Federations 27

SaaS Federations 28

SSO+ as a Service 29

Identity Aggregators 30  Single point of integration for all Nordic e-ID systems  Expanding into other regions…

Looking Ahead What is the impact of: User centric identity approaches Of course, this is in name only User centric becomes a reality when business models support it OpenID First party identity systems are not very interesting from a business perspective… Information Cards Unlike OpenID, info cards have a real security model But the market is not responding OSIS, Information Card Foundation, Identity Commons, Higgins, Identity Metasystem Interop TC, etc Can someone please explain this to me? 31

In Review State of federation is strong – but the game is changing Business models are driving up demand for federation technology – and forcing still other changes Federation and SSO services – an emerging trend to watch 32

33 Current State of Federated Identity References Burton Group’s Identity and Privacy Strategies In Search of the Internet Identity System: Contrasting the Federation Approaches of SAML, WS-SX, and OpenID Federation’s Future in the Balance: Teetering Between Ubiquity and Mediocrity Business and Legal issues in Federations A Relationship Layer for the Web… and Enterprises, Too

34 Current State of Federation Technology References Burton Group’s Identity and Privacy Strategies In Search of the Internet Identity System: Contrasting the Federation Approaches of SAML, WS-SX, and OpenID Federation’s Future in the Balance: Teetering Between Ubiquity and Mediocrity Business and Legal issues in Federations Information Card Landscape A Relationship Layer for the Web… And Enterprises, Too