Federated identity management is a relatively new concept that is an extension of identity management, which is a centralised, automated approach to regulating access to enterprise resources by employees and other authorised individuals.
The focus of identity management is defining an identity for each user (human or process), associating attributes with the identity and enforcing a means by which a user can verify identity. Once implemented, identity-management systems support single sign-on (SSO), the ability of a user to access all network resources after a single authentication.
Federated identity management refers to the agreements, standards and technologies that enable the portability of identities, identity attributes and entitlements across multiple enterprises and numerous applications, supporting thousands, even millions, of users.
When multiple organisations implement interoperable federated identity schemes, an employee in one organisation can use SSO to access services across the federation with trust relationships associated with the identity.
Beyond SSO, federated identity management provides other capabilities. One is a standardised means of representing attributes. Increasingly, digital identities incorporate attributes other than an identifier and authentication information (such as passwords and biometric information). Attributes can include account numbers, organisational roles, physical location and file ownership. And a user may have multiple identifiers associated with multiple roles, each with its own access permissions.
Another key function of federated identity management is identity mapping. Security domains may represent identities and attributes differently. Further, the amount of information associated with an individual in one domain may be more than is necessary in another domain. The federated identity-management protocols map identities and attributes of a user in one domain to the requirements of another domain.
A generic federated identity-management architecture includes identity providers and service providers. The identity provider acquires attribute information through dialogue and protocol exchanges with users and administrators.