About This Site

This blog is intended to share, cooperate with and learn from IT professionals serving the public sector. It is my intent that this blog may evolve to become a public sector industry forum for the exchange of technology advice, reviews, experiences, recommendations and best practices.

Search

Search Government Blog

SAML and Federated Identity Initiative Make Big Advancement

The federal Government's push of SAML (Security Assertion Markup Language) as a standardized e-authentication and identity management system moved forward with the help of GSA (General Services Administration). This is a great accomplishment and endorsement for all of us trying to advance interoperability via the E-Authentication Federated Identity and Authentication Initiative program and achieve a standard protocol in all (or most) identity management products.

Progress on this IT aid has been slow but is now picking up steam. If you're not familiar, the e-authentication program was created in 2002 and is sponsored by an alliance of 160 private and public sector organizations including the GSA and Defense Department. According to Tom Kireilis, GSAs program executive, the purpose of the e-authentication program "is to provide credentialing services for outward facing government applications on the Web." The program provides Assurance Level 1 and 2 credentials, which are typically a user ID and password. The program is intended to permit system users single sign on capabilities so they can authenticate once and freely traverse across integrated systems. This efficiency has the potential to save massive dollars in system integration projects, improve security (as users won't be forced to maintain many different User ID's and passwords), improve the user experience and increase user productivity.

Identity federation requires a common standard that can be embedded by product manufacturers. The e-authentication program started with SAML 1.0 as the identity protocol for user authentication when it first went live in 2005. Two months ago, the program upgraded to SAML 2.0 and the GSA which had previously performed testing turned over the testing of the standard to the Liberty Alliance Project. Liberty Alliance chose Drummond Group to provide SAML 2.0 interoperability testing.

GSA has thus far certified seven information technology solutions under its interoperability testing guidelines, however, that number is expected to dramatically increase. Analyst firm Gartner recently commented in a research report that the federal government's commitment to SAML will bolster mainstream adoption of the markup language and federation capability. The report stated "The U.S. government's adoption puts considerable weight behind the standard and its continued maturation." This has a big savings potential for me so expect future blog posts on this topic as SAML advances and acquires mainstream vendor adoption.

Posted December 14, 2007 in Information Systems
Technorati: GovernmentIT  Add to Technorati Favorites
Del.icio.us: GovernmentIT  Save this page to del.icio.us
View CC license
Permalink | Comments (0) | Trackback (0)

Please forward COMMENTS to howard[at]governmentblogger.com.

Trackback for this post is http://www.governmentblogger.com/saml.htm.

READER COMMENTS

SAML in Security Frameworks
Is SAML part of the NIST C&A or FIPS 199?
Posted by Bret on December 17, 2007

Not Yet; But Hopefully in the Future
It's a bit premature for SAML incorporation to the NIST certification and accreditation, however, I hope and expect that it will eventually happen.
Posted by Howard on December 17, 2007