Liberty Alliance unveils certification test
The goal is to assure buyers that ID management products work well together
Computerworld - DENVER -- The Liberty Alliance Project this week announced a certification test designed to ease concerns about interoperability between products in the fast-growing identity management market.
The certification includes the Liberty Interoperability Logo to assure buyers that a vendor's products have passed a battery of tests designed to prove that users can federate and support single sign-on using authentication, authorization and provisioning layers from different identity management products.
"We have well over two dozen Liberty-compliant products shipping," said Michael Barrett, president of the Liberty Alliance management board and vice president of Internet strategy at American Express Co. "With the growing maturity and adoption of the alliance's specifications, our work needs to focus now on alleviating the business complexity of implementing identity federation.
"This assists the buyer in knowing that the products will work with one another if they buy logoed products," he said.
The Liberty Alliance is a group of more than 170 vendors and end-user companies formed in 2001 to develop industry standards for identity management and identity-based services. The test announcement took place at the Digital ID World exhibition here.
The Liberty Alliance is one of several bodies now working on setting identity management standards. Barrett downplayed any rivalry with the Web Security Federation (WS-Federation), a group led by Microsoft and IBM that has been issuing security standards to secure Web services. Each of the two groups submits technologies for security industry standards under the auspices of the Organization for Structured Information Standards (OASIS).
"We've had discussions [with the WS-Federation] regarding cooperation and convergence," said Barrett. "We have been consistently saying for a long time that interoperability and then convergence is the likely path for the future. We are working on cooperation and convergence [with the WS-Federation]. A great deal of analysis needs to be done, and we are in the early stages of that."
"We've adopted parts of the WS-Security specifications into Liberty standards," said Simon Nicholson, chairman of the Liberty Alliance business and marketing group. "We're waiting to hear from the other parties."
According to Roger Sullivan, CEO of Phaos Technologies and the head of the Liberty Alliance certification team, the tests will reproduce a real-world identity federation problem.
Companies doing the testing need not be Liberty Alliance members, he said, and "each party testing with the Liberty specification will have a unique implementation of a federation process." The tests will link competitive products and will be organized by vendors using the federation demonstration from the March 2003 RSA Security Conference as a guide. That proof-of-concept demonstration linked identity products from 20 vendors at theSan Francisco conference using security assertions based on the Security Assertion Markup Language.
Specific functionality to be evaluated includes a single sign-on for trusted access to multiple secure systems hosting data such as 401(k) retirement accounts or various health care accounts. De-federation, or unlinking the accounts, is also part of the test, he said, with 10 to 15 specific federation steps to be evaluated, Sullivan said.
All vendors undergoing testing must sign nondisclosure agreements to guarantee confidentiality.
The first test is planned in Madrid for Nov. 11-14, with plans to hold one test each quarter in a different country.
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts