October 30, 2003

Standardizing Authentication Using the Security Assertion Markup Language (SAML)

Security Pipeline published an article on how to use Security Assertion Markup Language (SAML) to provide authentication. Its a pretty good read, even if you are not an XML/SAML demi-god.

I still think there needs to be vendor buy in for this. Standardizing a markup lanugage which is fragmented will not help the industry at all. Everyone has to get together and agree to this thing. Course, same could be said with the HTML standard *lol*

Posted by SilverStr at October 30, 2003 10:09 AM | TrackBack
Comments

To play the devil's advocate...

Why are they coming up with SAML? What's wrong with Pluggable Authentication Modules, which have been a standard for some number of years already?

It's disappointing that the Microsoft Operating Systems have such a limited number of authentication stores. Rhetorical questions: Why can I have a simple /etc/passwd & shadow if I really wanted? Or a mysql or OpenLDAP based system? Or if I was crazy, let me write my own custom one using XML or Radius or some such?

Posted by: Wim at October 30, 2003 11:31 PM

I'm using SAML right now on WebSphere and Tivoli Access Manager. It is truly an excellent tool to
universalize SSO especially cross domain SSO.
I'm also implementing an enterprise Web Service
application using SAML for identity Federation.
You may want to try SAML again because it is
becoming part of the security industry.
Goos Luck to you. I hope things work out better.

Posted by: jharney at April 2, 2004 07:30 PM