GSA signs on with SAML

The government's push toward E-Authentication and federated identity management has given a boost to the Security Assertion Markup Language, industry analysts say.

Federal program managers say the government's pioneering interoperability testing program for the E-Authentication Federated Identity and Authentication Initiative has helped drive standard implementations of the protocol in identity management products.

The E-Authentication program, established in 2002, was using SAML 1.0 as the protocol for user authentication when it first went live in 2005. In September the program adopted SAML 2.0, and the General Services Administration announced it was turning interoperability testing over to the Liberty Alliance Project.

That project, a coalition of 160 industry, nonprofit and government organizations including GSA and the Defense Department, sponsors standards development for federated identity management.

E-Authentication Solutions forms part of the administration's e-government initiative. 'The purpose is to provide credentialing services for outward-facing government applications on the Web,' said Tom Kireilis, GSA's acting program executive.

The E-Authentication program provides Assurance Level 1 and 2 credentials, which can be a user ID and password. Program leaders seek to build a system that would allow users to sign on across many applications using a single set of credentials.

In addition to the domestic program, several other national governments are deploying SAML 2.0-based applications to enable identity- based access. Use of a common standard could allow federated identity access controls across multiple enterprises.

Federated identity management projects are gaining momentum because providing user authentication separately for each of the hundreds of public-facing government applications entails needless costs for the enterprises supporting them and irksome burdens for users who now must maintain multiple IDs and passwords to access different online resources.

'Wouldn't it be great if we could use just one' user ID and password to access multiple applications? Kireilis asked rhetorically. Federation enables access across a variety of resource providers, using the same infrastructure and a network of trust.

'In an identity federation, management of the end user's identity might be performed by agencies other than your own,' said Dave Temoshok, director of ID policy and management at GSA's Governmentwide Policy Office.

This interoperability requires a common standard that can be employed by product manufacturers. SAML specifies an Extensible Markup Language standard for exchanging data for authentication and authorization between security domains.

In a recent research report, Gartner concluded that the federal commitment to SAML bolsters mainstream adoption of the language.

'The U.S. government's adoption puts considerable weight behind the standard and its continued adoption and maturation,' the report states.

But a common standard does not necessarily ensure that products created by different companies will work with one another, because standards can be interpreted and implemented differently by each. The E-Authentication program established a formal testing program to ensure interoperability.

The testing program 'is essential for us, and I think it's essential for any other large-scale deployment using Security Assertion Markup Language,' Temoshok said. Until recently, GSA did that testing. 'We established an interoperability testing program because there was no testing program on the industry side,' he said.

Kireilis said the federal testing program consumed a lot of resources, so officials concluded that the testing operation should shift to the private sector once a program became available. 'Given the community that Liberty Alliance represents, they were in the perfect place to provide the testing for us.'

Liberty Alliance launched its testing program in 2003 and has certified 80 products since then. The group recently selected Drummond Group to provide SAML 2.0 interoperability testing.

GSA has certified seven products under its interoperability testing program so far. That total could expand rapidly, Kireilis said, and eventually the number of products tested could range in the hundreds.

Attracting attention

Temoshok said that E-Authentication interoperability testing has noticeably shaped trends in SAML-enabled products development.

'It got standard interpretations for the standard in place,' he said. 'As a result, we have seen a greater convergence around the standards in SAML 2.0.'

There are now 65 relying parties or applications in the E-Authentication Federation that use the technologies.

'We'll more than double that this year,' Kireilis said. The Office of Management and Budget has directed agencies to prepare plans for enabling targeted applications, and GSA has been working with them in developing their timelines. 'So we know what is coming down the road,' Kireilis said.

Each agency will separately choose which of its applications to enable for E-Authentication, because the process can be expensive and it will have to show a return on that investment. 'They need to do that in a way that makes sense,' Temoshok said.

Although E-Authentication has had a slow start, Temoshok is not discouraged by the progress.

He said it took 20 years before identity management and remote access to services through automated teller machines owned by different companies gained acceptance in the banking industry. The government's challenge is more complex because of the multiple levels of security involved. 'We're still in the early steps,' he said.