Every few years Microsoft issues another grand, unified plan for identity management. Well, they’ve done it again.
At the turn of the millennium, Microsoft launched Passport, an initiative under which the vendor sought to become the world’s pre-eminent identity aggregator and authentication service. A few years later, Microsoft issued a comprehensive Web services security road map that included the WS-Federation protocol and marginalized Passport’s role in identity management. Now we have a new Microsoft strategy, Identity Metasystem, which grants WS-Federation and such rivals as the Security Assertion Markup Language (SAML) more or less equal footing.
Why is Microsoft distancing itself from its previous identity management strategies? The reason is simple. Neither Passport nor WS-Federation has gained much industry support beyond a hard core of Microsoft’s closest business partners while the rest of the industry has flocked to SAML.
Microsoft’s new party line for identity management stresses the need for a universal identity environment that supports interoperation of multiple identity technologies run by multiple identity providers. This represents a 180-degree turn away from WS-Federation and Passport. The former was intended to serve as the single universal federated identity management protocol; the latter was positioned as an uber-identity provider for all of cyberspace.
To a great extent, the Identity Metasystem strategy repackages the core WS specifications that Microsoft has championed over the past three years. Microsoft hasn’t totally abandoned WS-Federation but now positions it as the federated identity management plumbing within the Active Directory Federation Services feature of Windows Server 2003 and Longhorn.
The only truly new component of Microsoft’s identity management strategy is InfoCard, which will be implemented in Longhorn. InfoCard is a privacy-protection feature within the Longhorn client. It will provide a secure client-side store of identity information for authenticating to various relying services. Users also will be able to selectively withhold privacy-sensitive InfoCard identity attributes from relying services, and to define and enforce policies regarding which relying services may access which client-store attributes.
Privacy protection is the principle theme of Microsoft’s new identity management strategy. This comes through loud and clear in the identity laws promulgated by Kim Cameron, the mastermind behind the strategy. Cameron says identity management systems must gain user consent before revealing information identifying the user; disclose the minimum amount of identifying information necessary; limit that disclosure to parties with a need to know; provision public and private identifiers for pointing to users’ identity data; and provide user interfaces that help people avoid revealing personal information to phishing and pharming scams. Missing from Cameron’s laws is any mention of trust management, strong assurance, multifactor authentication, single sign-on, role-based access control, confidentiality, integrity, nonrepudiation, audit, compliance and governance.
It’s good to see Microsoft recognizes where it went astray in its previous identity management visions. But its new strategy is too narrowly focused to serve as the basis for a truly universal, general-purpose, federated identity management environment. And its InfoCard mechanism does little to address the threat of identity theft on server-based identity providers throughout the federated world. Microsoft needs to think through these issues more comprehensively before releasing grandiose new vision statements.
QuickLink 058456
–Kobielus is a senior technical systems analyst at Exostar, a business-to-business trading exchange serving the aerospace and defense industry. He can be reached at (703) 924-6225 or [email protected]. The opinions expressed are his own.
