(Security Services Technical Committee)
with key contributions from the LibertyAlliance Project.
SAML established a common XML (Extensible Markup Language)vocabulary for the exchange of authentication and authorization information acrosstrust boundaries. It has gained significant adoption in vertical markets and communitiessuch as universities and wireless carriers where the participants generally have pre-existing trust relationships of some kind.However SAML was not optimized for “wide open” trust networks, such as the Internet,where the parties to a digital identity interaction may not have any pre-existing trustrelationship. To fill this need, two new
open identity technologies
have been developed:
is a Web registration and single sign-on protocol that lets users registerand login to OpenID-enabled websites using their own choice of OpenIDidentifier. With OpenID, a user can operate their own OpenID service (such ason their blog), or they can use the services of a third-party OpenID provider (forexample, most major Web portals, such as AOL, Google, and Yahoo, now offerOpenID service). One key advantage of OpenID is that it requires no client-sidesoftware—it works with any standard Internet browser. OpenID is a community-developed open standard hosted by the non-profit OpenID Foundation.
are a new approach to Internet-scale digital identity in whichall of a user’s identities, whether self-created or from third party identityproviders (e.g., employer, financial institution, school, government agency, etc.)are uniformly represented as visual “cards” in a software application called a
The cards themselves may be stored on the same computer asthe card selector, or on a mobile device, or “in the cloud”
Cards may beexchanged with websites using a variety of protocols and formats. All cardselectors support at least the
developed by the OASIS IMI TC,
however Information Cards are now being adapted to other protocols as well(including OpenID). Information Card technology is developed and promoted bythe non-profit Information Card Foundation.
OpenID and Information Cards are often called “user-centric” or “user-driven” identitytechnologies because they put the user in control of all identity-based interactions.Specifically, they put the user in the middle of connecting two parties to a digital identitytransaction:
(also called a
) is the website or service thatrequires a security credential from the user.
is the website or service providing a security credential (suchas an authentication or authorization assertion) on behalf of the user. (Note that in thecase of self-asserted identity credentials, the user is his/her own identity provider.) Thissecurity credential may contain a set of
) that the identityprovider asserts about the user, e.g., name, address, age, gender, etc.