The Liberty Alliance was formed in September 2001 by approximately 30 organizations to establish open standards, guidelines and best practices for identity management. Today it has a global membership of more than 150 organizations, including technology vendors, consumer-facing companies, educational organizations and governments from around the world, as well as hundreds of additional organizations that participate in Liberty's various open community Special Interest Groups (SIGs). It has released Frameworks that address Federation (since contributed to OASIS for the SAML standard), Identity Assurance, Identity Governance, and Identity Web Services, as various services applications. It has also been active in privacy and policy issues relative to identity.
As of 2006, the Liberty Alliance has tracked well over one billion Liberty-enabled identities and devices in fields as diverse as defense & law enforcement to telecommunications to egovernment. Management Board members include AOL, British Telecom, Computer Associates (CA), Fidelity Investments, Intel, Internet Society (ISOC), Novell, Nippon Telegraph and Telephone (NTT), Oracle Corporation and Sun Microsystems.
As of June 2009, the work of the Liberty Alliance is transitioning to the Kantara Initiative.
Contents |
In July 2002, the Liberty Alliance released its first public specifications, Liberty Identity Federation (ID-FF) 1.0. At this time, several member companies also announced upcoming availability of Liberty-enabled products, marking very rapid release and deployment of open specifications developed by a consortium like the Liberty Alliance. Liberty Federation allows consumers and users of Internet-based services and e-commerce applications to authenticate and sign-on to a network or domain once from any device and then visit or take part in services from multiple Web sites. This federated approach does not require the user to re-authenticate and can support privacy controls established by the user. The Liberty Alliance released two more versions of the Identity Federation specification, and then in June 2003 contributed its federation specification, to OASIS, forming the foundation for SAML 2.0. Today, many organizations have deployed interoperable solutions that support SAML 2.0. In 2007, Gartner, an industry analyst firm, declared SAML 2.0 "the de facto federation standard across industries."[1]
Liberty Alliance also focused on identity web services standards, publicly releasing the Liberty Identity Web Services Framework in April 2004. Liberty Identity Web Services is an open framework for deploying and managing a variety of identity-based Web services. Liberty Web Services applications include Geo-location, Contact Book, Calendar, Mobile Messaging and Liberty People Service, a Web services framework for managing social applications such as bookmarks, blogs, calendars, photo sharing and instant messaging in a secure and privacy-respecting federated social network. In the October 2008 report "Federated Identity," Burton Group recommends organizations consider Liberty Alliance ID-WSF 2.0 specifications when implementing federation.[2]
In an effort to grow the identity marketplace, the Liberty Alliance introduced the Liberty Interoperable (TM) certification program in 2003, designed to test commercial and open source products against published standards to assure base levels of interoperability between products. Currently, more than 80 products have passed testing. In 2007, the US GSA began requiring successful completion of this certification test as a prerequisite for participating in the US E-Authentication Identity Federation.
In January 2007, the Liberty Alliance announced the OpenLiberty Project, a global initiative formed to provide resources and support to open source developers building identity-based applications. OpenLiberty.org is a portal where developers can collaborate in the OpenLiberty Project and access tools and information for "jump starting" the development of more secure and privacy-respecting applications based on the widely deployed Liberty Federation and Liberty Web Services standards. In November 2008, OpenLiberty released the open source ArisID API, providing enterprise developers and system architects with a library for building enterprise-grade identity-enabled applications using multiple identity protocols.
In February 2007, the Liberty Alliance began working on the Identity Governance Framework, releasing the first version publicly in July 2007. The Identity Governance Framework defines a set of standards to help enterprises easily determine and control how identity related information is used, stored, and propagated in appropriate and secure ways using protocols such as LDAP, SAML, and WS-Trust and ID-WSF.
The Liberty Alliance began work on the Identity Assurance Framework in 2008. The Liberty Identity Assurance Framework (IAF) details four identity assurance levels designed to ease and speed the process of linking trusted identity-enabled enterprise, social networking and Web 2.0 applications together based on standardized business rules and security risks associated with each level of identity assurance. The Assurance Levels are based on four levels of assurance outlined by the U.S. National Institute of Standards and Technology (NIST) Special Publication 800-63 version 1.0.1 {NIST800-63}, and range in confidence level from low to very high. The level of assurance provided is measured by the strength and rigor of the identity proofing process, the credential's strength, and the management processes the service provider applies to it. These four Assurance Levels have been adopted by the U.K. government, the Government of Canada and the U.S. Federal Government for categorizing electronic identity trust levels for providing electronic government services. These Assurance Levels are also recognized and referenced in the Liberty Alliance Identity Assurance Framework.
In 2007 the Liberty Alliance helped to found the Concordia Project, an independent initiative focused on driving harmonization of specifications in the identity space. It does this by soliciting and defining real-world use cases and requirements for the usage of multiple identity protocols together in various deployment scenarios, and encouraging and facilitating the creation of protocol solutions in the appropriate homes for those technologies.
Since inception, the Liberty Alliance has also focused on the business and policy aspects of identity management, publishing business and policy guidelines in a variety of forms for different business and legal audiences in a variety of vertical sectors. The Liberty Alliance hosted Privacy Summits across the globe in 2007 and 2008 to foster dialogue about and understanding of privacy issues in the identity space.
More than one billion Liberty-enabled identities and devices have been tracked globally as reported by different organizations and news outlets, across a variety of categories, including biometrics, commercial IT, defense & law enforcement, education, egovernment, escience, financial services, healthcare, HR, oil & gas, online service providers, outsourcers & service providers, real estate, standards organizations, technology, telecommunications, and travel & transportation.
|
The Kantara Initiative is a successor to Liberty Alliance, Concordia and others and has been formed by leaders of many foundations and associations working on various aspects of Digital identity to be a robust and well-funded focal point for collaboration to address the issues we each share: Interoperability and Compliance Testing, Identity Assurance, Policy and Legal Issues: Privacy, Ownership and Liability, UX and Usability, Cross-Community Coordination and Collaboration, Education and Outreach, Market Research, Use Cases and Requirements, Harmonization, Tool Development.
The Kantara Initiative is working to bridge the enterprise, mobile, government and Web communities to provide the industry with a clear path for moving interoperable identity systems forward, advancing adoption and meeting marketplace and user needs.