E-business initiatives - such as enterprise, B2B, and B2C applications - typically reach throughout and beyond an enterprise, requiring users to move across networks, applications, and security domains. To be effective, this movement must be transparent to the user. Consider what's involved in this: a single identity with one registration process and one login procedure. Not easy, considering hundreds, thousands or even millions of users require access to a growing number of applications which may or may not be under the direct control of the enterprise.

A single organization cannot effectively manage or control an e-business initiative from beginning to end, especially when multiple partners are involved. Even within the enterprise, different business units often manage distinct sets of users and resources. That's why organizations are turning to federated identity management to address their e-business challenges.

In a federated environment, a user logs on through his identity provider and then leverages that authentication to easily access resources in external domains. Federated identity standards form an abstraction layer over local identity and security environments of diverse domains. This abstraction layer provides for interoperability between disparate security systems inside and across domains, enabling true federation. Each domain maps to the agreed-upon policies without divulging sensitive user information. This trust is the foundation of any federated environment, and the organizations that work together within a domain are a circle of trust. A circle of trust connotes that both a business relationship and technical infrastructure are in place to assure secure access.

The Liberty Alliance is developing and delivering the first open architecture and specifications to enable federated identity management. At its core is the Identity Federation Framework (ID-FF), which facilitates identity federation and management through features such as identity/account linkage, single sign-on, and session management. ID-FF is fundamental to underpinning accountability in business relationships and Web services; providing customization to user experience; protecting privacy; and allowing adherence to regulatory controls.

The Liberty Alliance is also specifying an Identity Web Services Framework (ID-WSF) that will utilize the ID-FF. This framework introduces a Web services-based identity service infrastructure that enables users to manage the sharing of their personal information across identity and service providers as well as the use of personalized services. For example, a user may authorize a service provider to access their shipping address while processing a transaction.

Built on top of the ID-WSF is a collection of interoperable identity services, the Identity Services Interface Specifications (ID-SIS). The ID-SIS might include services such as registration, contact book, calendar, geo-location, presence, or alerts. Through Liberty protocols and a standard set of attribute fields and expected values, organizations will have a common language to speak to each other and offer interoperable services. The services defined in the ID-SIS are designed to be built on top of Web services standards, meaning they are accessible via SOAP over HTTP calls, defined by WSDL descriptions, and use agreed-upon schemas.

So what does this mean to businesses? Let's look at a Web services-enabled supply chain environment in which the order management system automatically triggers back-end transactions that span inventory control and accounts payable. A trusted partner of a large electronics manufacturer accesses the ordering system through a designated portal. To access this application, the user's digital credentials and role are shared in a federated fashion, allowing the user to place an order without entering login information that is unique to the partner's domain. The user's order - and role-based authority - triggers a query to the inventory management system to determine whether inventory levels are sufficient to fill the order. Based on the inputs provided by the requesting application, the inventory management system earmarks product for this order and notifies shipping to process it. The accounting system registers the order and starts the invoicing process.

Thanks to Web services, most of this is done without human involvement. But what would happen without a federated user identity? There is no telling the extent of havoc that would result if an unauthorized or "untrusted" user had access to this process. Federated identities and Web services together are primed to take e-business processes to the next level.

The Liberty Alliance unites more than 160 firms representing more than 1 billion consumers. Organizations like this will continue to strive to achieve digital identity standards that will facilitate e-business processes around the globe.

About the Authors
John Worrall is with RSA Security. Jason Rouault is with Hewlett-Packard. Both companies are founding members of the Liberty Alliance Project. www.projectliberty.org info@sys-con.com