1. Federation Systems, ADFS, & Shibboleth 2.0
Chad La Joie
Georgetown University / Internet2

2. Federations Foundation for business relationships Provide common:
Policy base
Protocol and Attribute Definitions
Participant Endpoint Metadata
Business Practices
Inter-federation agreements
Bi-lateral and multi-lateral trust on a business and technical oriented level

3. Federation Systems Federation Systems are not:
Virtual/Meta Directories
Identity Management systems
Account provisioning systems
Authentication systems
Authorization systems

4. Federation Systems Federation Systems:
Use existing identity management systems
Transmit authentication information
Transmit identity attributes
Release information based on policy
Identify, authenticate, and secure communication between endpoints

5. Active Directory Federation Service
WS-Federation Passive Profile Interoperability Scenario
SAML 1.1 Assertion Payloads
Web application, Single-Sign On focused
Supported in Windows 2003 Server, R2
Is not related to InfoCard

6. Active Directory Federation Service
Strong Points
Remote users mapped onto AD accounts and groups without need for shadow accounts
Expose AD user and attributes to standalone applications hosted on heterogeneous platforms
Easy to enable ADFS Account Partner (IdP) support for an AD system

7. Active Directory Federation Service
Weak Points
Currently does not inter-operate with MS products like Outlook Web Access
Endpoints described by non-standard metadata
Resource provider set up is confusing
Almost non-existent documentation of PKI mechanics
Difficult to implement mechanics to deal with new attributes
No plans to continue development of WS-Fed; InfoCard is the future

8. Shibboleth 2.0
What's new
Internalized authentication and a concept of a user session
Support for SAML 2.0
Single Sign-On, Single Logout, and Attribute Query
Persistent Identifiers
Enhanced Attribute Authority and Connectors
Java Service Provider
Better documentation
Scheduled for release end of 2006

9. Shibboleth 2.0 What's the same SAML 1.0 and 1.1 support
U.S. eAuth and ADFS support
Apache/IIS/iPlanet C++ SP
ARP and AAP policies

10. Shibboleth 2.0 What's not there Delegation/Proxy/N-Tier support
SAML 2.0 NameID mapping/management
WS-Security and WS-SX support
Account Linking