Virtual Federation: A Game of Ratios
Tuesday May 13, 2008
In many of my blogs I've written about Virtual Federation Proxy (VFP)a feature available in OpenSSO, the code base from which Sun's upcoming release Federated Access Manager 8 is derived. I've received lots of email from people asking me to explain the benefit of this feature in more detail so this blog focuses on explaining the problem that organizations are facing and how VFP can lower the overall total cost of ownership for web access management and federation infrastructure.
THE PROBLEM
Most organizations are still working toward internal single sign-on. That is, the majority of organizations still have multiple authentication points or reduced sign on (RSO). For example, an organization may still have separate sign-ons for it's Web Portal, HR System and Payroll system. It could be using Enterprise Single Sign On to simulate a SSO experience, but it still maintains three different authentication infrastructures. If that organization wants to begin federating with external service providers using all three applications it needs to deploy a federation service at each authentication point. In other words, an organization would need to deploy separate federation points for each applications -- Web Portal, HR system and Payroll system.
The problem with this is an organization needs to maintain more federation instances and infrastructure than it wants and would not be following federation best practices by implementing a single, centralized federation hub. In short, the ratio between an organizations authentication points to federation points would be a 1:1 ratio. That is, for every authentication point an organization maintains it would also need to deploy an additional federation point. This, oftentimes, is an inhibitor to beginning federation because many organizations believe they need to solve their internal single sign on issues before starting with federation.
THE SOLUTION: VIRTUAL FEDERATION PROXY (VFP)
VPN allows a company to lower infrastructure costs by reducing the # of federation instances, hardware, and ongoing support/maintenance costs required to support each individual authentication point. VFP changes the ratio of authentication points to federation points from a 1:1 ratio to an X:1 ratio. For example, the organization mentioned above that has 3 authentication points (Web Portal, HR System, Payroll System) would now only require one federation deployment to manage all 3 authentication points, a 67% reduction in hardware, software, and ongoing maintenance. In short, OpenSSO's Virtual Federation Proxy (VFP) solves this problem by unhinging any dependencies between internal SSO and federated SSO.
VPN does this by allowing organizations to add a plug-in to each authentication point that allows it to push federation data to OpenSSO when a user logs in. OpenSSO caches the federation data and then acts as a virtual proxy on behalf of each authentication point. For example, the company mentioned above that has three authentication points would deploy a basic plug-in to federate enable its Web Portal, HR System, and Payroll System. If a user logged in to the HR system and then tried to access a partner service during the authenticated session, for example an outsourced 401K service, OpenSSO would act as a proxy for the HR application and handle all communications with the 401K service using the cached data. Once the session is terminated the cached data is deleted from OpenSSO.
Finally, as an organization makes progress toward SSO they do not need to worry about constructing, maintaining and end-of-lifing multiple federation services. Instead, it can simply change how each application interacts with a single federation hub. In short, VFP allows organizations to architect a long-term federation solution that follows best practices, simplifies their path to federated single sign on, lowers total cost of ownership, and simplifies an organizations identity infrastructure in a pragmatic manner.
Peace out!
|
|
|
|
Tags: access federation fedlet identity liberty management microsystems opensso ping saml secure software sso sun virtual ws-federation
Hi Daniel - it would be useful to explain up-front...