Microsoft wants service-based identity platform

Microsoft is working on a series of upgrades to its directory and identity technologies in the coming months, with the goal of creating a service-based identity platform.


The services idea, however, is not far-fetched. Just last year, Microsoft CEO Steve Ballmer said at the company's annual partner conference that every piece of Microsoft's shrink-wrapped software would have a services element and he mentioned out Active Directory by name.

Last week, Joe Long, general manager of the connected identity and directory at Microsoft, wasn't quite that blunt.

"My team is focused on delivering products that solve enterprise problems," said Long. But he said the ultimate goal was to reduce complexity, and he showed a new management interface and a PowerShell script-driven automated tool for setting up federation that will ship during the 2008 "plus" time frame.

Active Directory Federation Service (ADFS) 2.0, also slated for that time frame, is where Microsoft plans to begin shifting from a web single sign-on model to more of a pluggable platform for applications.

"We want to make it so you can take these products, install them, and take advantage of them without having to work two months, two years, 10 years with a developer or integrator to get it to work."

Microsoft also detailed its concept of an identity bus that would be a plug-and-play service for applications needing to authenticate and authorise users.

Stuart Kwan, director of program management for identity and access for Microsoft, said the bus would feature "transformers", places where data contained within "claims" would be translated into different formats depending on an application's need. Kwan said the transformers could handle such things as Kerberos, X.509 certificates and assertions based on the Security Assertion Markup Language (SAML).

Claims can come from Active Directory, LDAPv3-based directories, application-specific databases and new user-centric identity models such as LiveID, OpenID and InfoCard systems, including Microsoft's CardSpace and Novell's Digital Me.

"Transformers allow us to fold, spindle and mutilate the data in any way we want. It lets us adapt to the infrastructure without completely destroying the applications," Kwan said.

In addition to the services angle, Microsoft said it is revisiting its stand on key protocols it does not support, which could prove critical to the success or failure of a services-based platform.

The protocols include the entireSAML 2.0 specification, Service Provisioning Markup Language and Extensible Access Control Markup Language.

"Microsoft has introduced an interoperability promise, and we are trying to understand the ramifications of that," said Long. "Hopefully we can make a commitment one way or the other in the next few months."

"Recommended For You"

Authenticating yourself in the cloud TriCipher launches hosted identity federation service