« Alan Kay Followup | Main | If Microsoft Sold the iPod... »
Federated Identity Checklist
I’m putting together a checklist of things to do to help federation succeed for the feature I’m writing for InfoWorld. Here’s my list so far. Any other’s that ought to be in there based on your experience?
- Find win-win situations where both parties benefit from the federation
- Start with internal projects
- Find an experienced partner for your first external federation
- Create a center of excellence in the CIO’s office
- Establish a federated identity council to get input from business users
- Educate the legal department about federation and develop an in-house legal expert
- Pay attention to privacy
- Make sure your policy creation process is up to speed and use it to build a set of identity policies
- Create an interoperability framework that outlines what standards and products to use
Posted by windley on February 28, 2006 4:51 PM
Comment from Neil Macehiter at March 1, 2006 3:51 AM
"Find win-win situations where both parties benefit from the federation". I agree completely. I would add that the benefits have to busiess, rather than technology, driven. This may be implied in your statement but it should be explicit. Without it the contractual agreements which underpin the technical federation will not be in place.
"Find an experienced partner for your first external federation". Again, I agree. However, related to your final point concerning the interoperability framework, it is essential to consider the potential ecosystem of partners you could federate with, to avoid creating a set of federated stovepipes.
It is important to consider the implications from an administrative point of view: delegated administration; regulatory compliance e.g. if users of your systems are being administered by a 3rd party what are the implications for compliance reporting.
Comment from Brian Baird at March 1, 2006 8:23 AM
I agree with the comments posted by Mr. Macehiter. Federation initiatives must be business driven. SLA/SLU documents must be in place. Legal contracts should be constructed with clear definitions around Information Risk Management. ASPs and other partners lacking business support will often draft documents that basically read "for entertainment purposes only". If partners in the federated ecosystem are not willing to accept the risks of economic loss or legal outcomes then you should remain the custodian of your own information. This may be accomplished using SAML, SPML, and other common instruments. Finally, initiatives must be measurable using "SMART" criteria to foster support.
I really value the information available on this site and look forward to the article.
Brian Baird
Comment from Scott Blackmer at March 2, 2006 5:12 AM
Revocation of identity credentials is also a key element of any federated scheme. Otherwise, federation amplifies the threat of fraud, identity theft, and misattribution of content and opinions, as one party after another relies on bad credentials. Federation should include a system for verifying challenges to identity credentials and suspending or revoking them when they have expired or become suspect. This might include contractual reference to a common (online) dispute resolution system (a la UDRP for domain name disputes) or to a challenge-and-take-down procedure (a la Digital Millennium Copyright Act for copyright disputes). The mechanism for avoiding reliance on outdated or misappropriated identity credentials will be a key element in insuring against risks and allocating legal liability.