Most enterprise customers are beginning to realize the value of identity and access management (IAM) technology as an integral part of their arsenal of security tools. Now, IT security operations groups should be paying particular attention to IAM providers that are focused on a strategy to simplify the implementation process. Users are being driven to adopt Identity Management (IdM) technology primary because of the need to comply with regulations such as HIPAA, SOX and PCI.

IAM implementations are tricky though, where IAM is eventually rolled-up into GRC (governance, risk and compliance). CIOs should be aware of some interesting trends over the next year, including the integration between IAM and DLP (data loss prevention) compliance technology, to support more automated response following breaches in company policies.

Vendors are also expected to launch integration projects between IdM and SIEM. If SIEM is integrated with technology that provides a broader view into identity, both systems become much more valuable.

Another interesting idea aimed at easing IAM deployments is to work IdM into SOA (service-oriented architecture), so software developers can avoid the chore of reverse-engineering for each application they are trying to write to. Rather than having to create capabilities (such as IdM) for every application that needs them, programmers can call upon parts of software referred to as services (under the SOA model) to more easily make changes to an app. A number of vendors, including Oracle, have been working toward these capabilities for some time now. The idea behind SOA is business agility and this should be music to a CIO's ears--especially one that is overseeing an IdM project where developers need to build connectors to a slew of company applications.

With Facebook Connect being abandoned in its favor, and a new draft specification before the IETF, OAuth is shaping up as the cornerstone of identity management for cloud-based applications and services.

OAuth (as in "Open Authorization") traces its beginning to the fall of 2006, when implementers of OpenID, including Blaine Cook, Twitter's lead developer at the time, Larry Halff of what is now Gnolia, Chris Messina, now with Google, David Recordon of Facebook, and others began discussing ways of delegating authentication through an API. Within a year, a draft of the core specification was ready for release. Since then, the specification has had its tires kicked in a number of implementations, and since last year, a working group of the Internet Engineering Task Force (IETF) has hashed over issues that must be resolved before OAuth can be properly considered a standard.

To the casual observer, this may sound a little like what we were promised with single sign-on (SSO), but that's not at all the case, said Hammer-Lahav. For one thing, the OpenID protocol would be a better comparison with SSO, and OAuth doesn't actually require OpenID at all. For another, OpenID's usefulness is in maintaining user logins across multiple sites, whereas OAuth removes the need to present that login to any site except the identity provider's. In practice, OpenID and OAuth complement each other.

Microsoft is expected to release Active Directory Federation Services 2.0, a key add-in to Windows Server 2008 that promises to simplify single sign-on authentication to multiple systems and the company's cloud-based portfolio. ADFS 2.0 (formerly code-named "Geneva"), provides claims-based authentication to applications developed with Microsoft's recently released Windows Identity Foundation (WIF).

Microsoft's claims-based Identity Model, implemented in the Windows Communication Foundation of the .NET Framework, presents authentication schema such as identification attributes, roles, groups and policies and a means of managing those claims, as tokens. Applications built by enterprise developers and ISVs based on WIF will also be able to accept these tokens.

ADFS 2.0 likely will prove important to Microsoft's overall cloud computing vision. Several Microsoft officials and outside observers believe that as enterprise customers, ISVs and software-as-service providers add ADFS 2.0 to their Windows Server environments, it will remove a key barrier to those reluctant to deploy their apps to the cloud.

Pass-through authentication in ADFS 2.0 is enabled by accepting tokens based on both the Web Services Federation (WSFED) and Security Assertion Markup Language (SAML) standards. While Microsoft has long promoted WSFED, it only agreed to support the more widely adopted SAML spec 18 months ago.

In the wake of the recent acquisition of Sun, Oracle has articulated a strategy to develop an integrated identity management stack that will combine the best products and capabilities of both organizations.

In particular, the new combination will mean increased research and development investment, more rapid innovation, continued support for open standards, and a much larger ecosystem of independent software vendors and system integrator partners and end users, according to Amit Jasuja, vice president of development for Oracle Identity Management. A cornerstone of Oracle's strategy will be the protection of current customer investment in Sun Identity Management through continued maintenance. "There will be no forced migrations," says Jasuja.

Here are five reasons why the Oracle-Sun combination will further strengthen two of the industry's strongest and most comprehensive identity management offerings:

1. Two Identity Management Leaders
2. Two Innovative Engineering Teams Become One
3. Complete, End-to-End Technologies
4. Identity and Access Governance
5. Protection of Existing Customer Investments

We are accepting applications for the Novell Identity Manager 4 - code name Dorado extended beta program. If you are interested in participating with Novell in the extended beta testing of this product we'd love to hear from you!

Novell Identity Manager 4 - code name Dorado is the industry's first solution that securely manages identity and access control across physical, virtual and cloud environments, through an intelligent identity-fabric that enables you to leverage your existing IT assets and new computing models like SaaS, while reducing cost and ensuring compliance. With a scalable, flexible infrastructure to extend policy-driven controls across resources beyond the firewall, manage costs and provide built in reporting, enterprises can ensure risk management and compliance without sacrificing business agility.

For more information about Novell Identity Manager 4, go to: http://www.novell.com/idm4launch