Liberty Alliance unveils certification test
The goal is to assure buyers that ID management products work well together
Computerworld - DENVER -- The Liberty Alliance Project this week announced a certification test designed to ease concerns about interoperability between products in the fast-growing identity management market.
The certification includes the Liberty Interoperability Logo to assure buyers that a vendor's products have passed a battery of tests designed to prove that users can federate and support single sign-on using authentication, authorization and provisioning layers from different identity management products.
"We have well over two dozen Liberty-compliant products shipping," said Michael Barrett, president of the Liberty Alliance management board and vice president of Internet strategy at American Express Co. "With the growing maturity and adoption of the alliance's specifications, our work needs to focus now on alleviating the business complexity of implementing identity federation.
"This assists the buyer in knowing that the products will work with one another if they buy logoed products," he said.
The Liberty Alliance is a group of more than 170 vendors and end-user companies formed in 2001 to develop industry standards for identity management and identity-based services. The test announcement took place at the Digital ID World exhibition here.
The Liberty Alliance is one of several bodies now working on setting identity management standards. Barrett downplayed any rivalry with the Web Security Federation (WS-Federation), a group led by Microsoft and IBM that has been issuing security standards to secure Web services. Each of the two groups submits technologies for security industry standards under the auspices of the Organization for Structured Information Standards (OASIS).
"We've had discussions [with the WS-Federation] regarding cooperation and convergence," said Barrett. "We have been consistently saying for a long time that interoperability and then convergence is the likely path for the future. We are working on cooperation and convergence [with the WS-Federation]. A great deal of analysis needs to be done, and we are in the early stages of that."
"We've adopted parts of the WS-Security specifications into Liberty standards," said Simon Nicholson, chairman of the Liberty Alliance business and marketing group. "We're waiting to hear from the other parties."
According to Roger Sullivan, CEO of Phaos Technologies and the head of the Liberty Alliance certification team, the tests will reproduce a real-world identity federation problem.
Companies doing the testing need not be Liberty Alliance members, he said, and "each party testing with the Liberty specification will have a unique implementation of a federation process." The tests will link competitive products and will be organized by vendors using the federation demonstration from the March 2003 RSA Security Conference as a guide. That proof-of-concept demonstration linked identity products from 20 vendors at theSan Francisco conference using security assertions based on the Security Assertion Markup Language.
Specific functionality to be evaluated includes a single sign-on for trusted access to multiple secure systems hosting data such as 401(k) retirement accounts or various health care accounts. De-federation, or unlinking the accounts, is also part of the test, he said, with 10 to 15 specific federation steps to be evaluated, Sullivan said.
All vendors undergoing testing must sign nondisclosure agreements to guarantee confidentiality.
The first test is planned in Madrid for Nov. 11-14, with plans to hold one test each quarter in a different country.
Read more about Security in Computerworld's Security Topic Center.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!