Liberty Alliance unveils certification test
The goal is to assure buyers that ID management products work well together
Computerworld - DENVER -- The Liberty Alliance Project this week announced a certification test designed to ease concerns about interoperability between products in the fast-growing identity management market.
The certification includes the Liberty Interoperability Logo to assure buyers that a vendor's products have passed a battery of tests designed to prove that users can federate and support single sign-on using authentication, authorization and provisioning layers from different identity management products.
"We have well over two dozen Liberty-compliant products shipping," said Michael Barrett, president of the Liberty Alliance management board and vice president of Internet strategy at American Express Co. "With the growing maturity and adoption of the alliance's specifications, our work needs to focus now on alleviating the business complexity of implementing identity federation.
"This assists the buyer in knowing that the products will work with one another if they buy logoed products," he said.
The Liberty Alliance is a group of more than 170 vendors and end-user companies formed in 2001 to develop industry standards for identity management and identity-based services. The test announcement took place at the Digital ID World exhibition here.
The Liberty Alliance is one of several bodies now working on setting identity management standards. Barrett downplayed any rivalry with the Web Security Federation (WS-Federation), a group led by Microsoft and IBM that has been issuing security standards to secure Web services. Each of the two groups submits technologies for security industry standards under the auspices of the Organization for Structured Information Standards (OASIS).
"We've had discussions [with the WS-Federation] regarding cooperation and convergence," said Barrett. "We have been consistently saying for a long time that interoperability and then convergence is the likely path for the future. We are working on cooperation and convergence [with the WS-Federation]. A great deal of analysis needs to be done, and we are in the early stages of that."
"We've adopted parts of the WS-Security specifications into Liberty standards," said Simon Nicholson, chairman of the Liberty Alliance business and marketing group. "We're waiting to hear from the other parties."
According to Roger Sullivan, CEO of Phaos Technologies and the head of the Liberty Alliance certification team, the tests will reproduce a real-world identity federation problem.
Companies doing the testing need not be Liberty Alliance members, he said, and "each party testing with the Liberty specification will have a unique implementation of a federation process." The tests will link competitive products and will be organized by vendors using the federation demonstration from the March 2003 RSA Security Conference as a guide. That proof-of-concept demonstration linked identity products from 20 vendors at theSan Francisco conference using security assertions based on the Security Assertion Markup Language.
Specific functionality to be evaluated includes a single sign-on for trusted access to multiple secure systems hosting data such as 401(k) retirement accounts or various health care accounts. De-federation, or unlinking the accounts, is also part of the test, he said, with 10 to 15 specific federation steps to be evaluated, Sullivan said.
All vendors undergoing testing must sign nondisclosure agreements to guarantee confidentiality.
The first test is planned in Madrid for Nov. 11-14, with plans to hold one test each quarter in a different country.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- 10 Things Your Next Firewall Must do Next-Generation Firewalls Defined
- Firewall Buyers Guide Operate as the core of your network security infrastructure
- Getting Started With a Zero Trust Approach to Network Security The Traditional Approach to Network Security is Failing. View Now>>
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts