Liberty Alliance advances online federation of identity

By Alun Williams

Posted on 13 Nov 2003 at 14:56

The Liberty Alliance has fleshed out its plans for managing user identities across Web Services - a key area for the future of the Internet in terms of managing security, privacy and the generating commercial revenues.

Created back in September 2001, with a membership including Sun, Nokia, HP, Ericsson, Verisign and Sony, the Alliance is concerned with the management of online user identities (a rival to Microsoft's Password, if you will). And it has now announced the approval of its Phase 2 specifications, and the release of new Service Interface Specifications (for managing personal profiles) and a Privacy and Security Best Pracices guide.

A draft release of the specification was published back in April - Liberty Alliance expands its influence - and it just rounds out existing Alliance work, building on the Liberty Federation Framework and the Liberty Identity Web Services Framework (the Phase 1 specifications related to simplified sign-ons and the online linking of opt-in accounts).

The new specs are available for download as reference to those who wish to develop Liberty-enabled applications - see www.projectliberty.org.

Among the companies announcing implementations based on the latest Liberty Alliance models are Sun and Vodafone.

Sun Microsystems, one of the driving forces behind the creation of the Alliance, says it plans to extend Java enterprise support (through its Java System Identity Server) to include Phase 2 support.

Vodafone has also declared plans to deploy Phase 1 and Phase 2 Liberty standards, both in its intranet and commercial service platforms. This will appear in platform releases scheduled for 2004-5.

A particular focus of the Alliance is in using existing open industry standards such as XML, SOAP and WS-Security, rather than a single proprietary approach.

'The Liberty Alliance is unique among standards-setting organisations,' said Michael Barrett, president of the Liberty Alliance and VP of security at American Express. 'While other forums are producing technology platforms for building web services, only the Liberty Alliance is devoting attention to not only building standards but providing the business and policy best practices that allow those standards to work across industries, across the globe and in a privacy and security-enhancing manner.'

As part of the announcements the Alliance also released its final 'Privacy and Security Best Practices' guide. This covers privacy laws and suggestions for dealing with common network vulnerabilities.

What next for the future, in Phase 3? A new Services Expert Group has been formed to develop further 'Identity Service Interface Specifications' (ID-SIS) for use with the Liberty Identity Web Services Framework.

Two of these have been released today: an ID-Personal Profile, which defines a standard template for basic registration information; and an ID-Employee Profile, a subset of the former but which is targeted at internal employees.

In Phase 3, the Alliance says, three new specifications will be defined: a Contact Book Service Interface (a common method for users to manage and share personal or business contacts, in a non-proprietary way), which could be used for billing or shipment addresses; a Geo-location Service Interface (automatically identify a person's location, at the user's request), which could be used to provide weather or travel services; a Presence Service Interface (to share presence information), useful to any service provider looking to communicating someone's availability, for example corporate instant messaging services.