The document discusses the evolution of federated identity protocols over the past 10+ years. While OAuth 2.0 is now widely adopted for federating web identities, the document argues that federation protocols alone are not sufficient. It suggests that applications also need ways to: 1) scope trust with federated identity providers, 2) provision access for federated identities, and 3) enable collaboration across federated identities. The document calls on the audience to build on existing work and find standards-based solutions to make these capabilities easier.

2. Beyond Federation Protocols
Praerit Garg
GM, AWS Identity & Directory Services

3. Copyright © 2015 Cloud Identity Summit . All rights reserved.
3
Rewinding the clock…
Infoworld, July 2002
“In a talk here at the Burton Group
Catalyst Conference 2002, Praerit Garg,
Microsoft group program manager,
detailed the company's vision for federated
security, which will in the future include
room for SAML (Security Assertion
Markup Language).”
Infoworld, July 2002

4. Copyright © 2015 Cloud Identity Summit . All rights reserved.
4
10+ Years, 2 career detours later…

5. Copyright © 2015 Cloud Identity Summit . All rights reserved.
5
Google search for federation yields…
OAuth 2.0 is broadly adopted for federating Web Identities – Google,
Facebook, Amazon, Microsoft, Twitter*, …
OAuth2 SAML Assertions support is standards track and gaining traction
But, SAML is DEAD! (OpenID Connect is the future)
97% OF SAAS VENDORS BACKING SAML-BASED SINGLE SIGN-ON
Cloud Security Alliance and OneLogin Survey, 2014
OAuth Wikipedia Page
Craig Burton
IETF, Phil Hunt’s blog, Salesforce

6. Copyright © 2015 Cloud Identity Summit . All rights reserved.
6
Federated Identities are now powering the Cloud Economy
Congratulations and Thank You!

7. Copyright © 2015 Cloud Identity Summit . All rights reserved.
7
But…
Have we simply adapted
Kerberos protocols for the
web?
Replaced ASN.1 encoding
with XML and now JSON?
I HEARD YOU LIKE ASN.1
SO I PUT AN OCTET STRING
IN YOUR OCTET STRING
SO YOU CAN PARSE WHILE
YOU PARSE

8. Copyright © 2015 Cloud Identity Summit . All rights reserved.
8
Unfortunately,
federation protocols aren’t sufficient
(those pesky “assertions” or “claims” matter)

9. Copyright © 2015 Cloud Identity Summit . All rights reserved.
9
1. Apps need to scope the trust with federated IDPs?

10. Copyright © 2015 Cloud Identity Summit . All rights reserved.
10
Mapping SAML Attributes to AWS Policy Keys

11. Copyright © 2015 Cloud Identity Summit . All rights reserved.
11
Federating using AWS Directory Service

12. Copyright © 2015 Cloud Identity Summit . All rights reserved.
12
2. Apps need to provision access for a federated Ids?

13. Copyright © 2015 Cloud Identity Summit . All rights reserved.
13
3. Apps need to enable collaboration experiences
across federated identities?

14. Copyright © 2015 Cloud Identity Summit . All rights reserved.
14
Call to Action
• Build on the great work you’ve all done thus far
• Find standards based solutions to
• make it easy to setup federated trust policies
• make it easy to provision access to federated
identities – e.g. identity lookups
• make it easy to enable collaboration experiences
across federated identities – e.g. identity search

15. Questions? Thoughts?