Federation Services

OpenSSO Enterprise provides an open and extensible framework for identity federation and associated web services that resolve the problems of identity-enabling web services, web service discovery and invocation, security, and privacy. Federation Services are built on the following standards:

• Liberty Alliance Project Identity Federation Framework (Liberty ID-FF) 1.1 and 1.2

• OASIS Security Assertion Markup Language (SAML) 1.0 and 1.1

• OASIS Security Assertion Markup Language (SAML) 2.0

• WS-Federation (Passive Requestor Profile)

Federation Services allows organizations to share identity information (for example, which organizations and users are trusted, and what types of credentials are accepted) securely. Once this is enabled securely, federating identities is possible — allowing a user to consolidate the many local identities configured among multiple service providers. With one federated identity, the user can log in at one identity provider’s site and move to an affiliated site without having to re-establish identity. Figure 2–10 illustrates the interactions between local and remote components of the Federation Services in a OpenSSO Enterprise deployment.

Figure 2–10 Federation Services Components within a OpenSSO Enterprise Deployment

More information on the Federation Services can be found in the Open Federation Architecture and the Federation Use Case documentation on the OpenSSO web site. Also, see Part III, Federation Management Using OpenSSO Enterprise in this book.