Liberty Alliance unveils certification test

Computerworld - DENVER -- The Liberty Alliance Project this week announced a certification test designed to ease concerns about interoperability between products in the fast-growing identity management market.
The certification includes the Liberty Interoperability Logo to assure buyers that a vendor's products have passed a battery of tests designed to prove that users can federate and support single sign-on using authentication, authorization and provisioning layers from different identity management products.
"We have well over two dozen Liberty-compliant products shipping," said Michael Barrett, president of the Liberty Alliance management board and vice president of Internet strategy at American Express Co. "With the growing maturity and adoption of the alliance's specifications, our work needs to focus now on alleviating the business complexity of implementing identity federation.
"This assists the buyer in knowing that the products will work with one another if they buy logoed products," he said.
The Liberty Alliance is a group of more than 170 vendors and end-user companies formed in 2001 to develop industry standards for identity management and identity-based services. The test announcement took place at the Digital ID World exhibition here.
The Liberty Alliance is one of several bodies now working on setting identity management standards. Barrett downplayed any rivalry with the Web Security Federation (WS-Federation), a group led by Microsoft and IBM that has been issuing security standards to secure Web services. Each of the two groups submits technologies for security industry standards under the auspices of the Organization for Structured Information Standards (OASIS).
"We've had discussions [with the WS-Federation] regarding cooperation and convergence," said Barrett. "We have been consistently saying for a long time that interoperability and then convergence is the likely path for the future. We are working on cooperation and convergence [with the WS-Federation]. A great deal of analysis needs to be done, and we are in the early stages of that."
"We've adopted parts of the WS-Security specifications into Liberty standards," said Simon Nicholson, chairman of the Liberty Alliance business and marketing group. "We're waiting to hear from the other parties."
According to Roger Sullivan, CEO of Phaos Technologies and the head of the Liberty Alliance certification team, the tests will reproduce a real-world identity federation problem.
Companies doing the testing need not be Liberty Alliance members, he said, and "each party testing with the Liberty specification will have a unique implementation of a federation process." The tests will link competitive products and will be organized by vendors using the federation demonstration from the March 2003 RSA Security Conference as a guide. That proof-of-concept demonstration linked identity products from 20 vendors at theSan Francisco conference using security assertions based on the Security Assertion Markup Language.
Specific functionality to be evaluated includes a single sign-on for trusted access to multiple secure systems hosting data such as 401(k) retirement accounts or various health care accounts. De-federation, or unlinking the accounts, is also part of the test, he said, with 10 to 15 specific federation steps to be evaluated, Sullivan said.
All vendors undergoing testing must sign nondisclosure agreements to guarantee confidentiality.
The first test is planned in Madrid for Nov. 11-14, with plans to hold one test each quarter in a different country.

Read more about Security in Computerworld's Security Topic Center.