Dynamic Identity Federation Using Security Assertion Markup Language (SAML)

Abstract

Abstract. Security Assertion Markup Language (SAML, in short) is one of the most widely used technologies to enable Identity Federation among organisations from different trust domains. Despite its several advantages, one of the key disadvantages of SAML is the mechanism by which an identity federation is established. This mechanism lacks flexibility to create a federation in a dynamic fashion to enable service provisioning (or de-provisioning) in real time. Several different mechanisms to rectify this problem have been proposed. However, most of them require a more elaborate change at the core of the SAML. In this paper we present a simple approach based on an already drafted SAML Profile which requires no change of the SAML, rather it depends on the implementation of SAML. It will allow users to create federations using SAML between two prior unknown organisations in a dynamic fashion. Implicit in each identity federation is the issue of trust. Therefore, we also analyse in detail the trust issues of dynamic federations. Finally, we discuss our implemented proof of concept to elaborate the practicality of our approach.

A Hybrid Model of Attribute Aggregation in Federated Identity Management

“…The implementation supports two types of SAML IdPs: trusted and semi-trusted. A trusted SAML IdP is the one which has been federated in the traditional way by exchanging metadata at the admin level whereas a semi-trusted SAML IdP is the one that has been federated using the concept of dynamic federation (Ferdous & Poet, 2013b). In addition, the Hybrid IdP determines the LoA for each IdP in this way: attributes from the Hybrid IdP or from any trusted SAML IdP will have a LoA value of 2 whereas attributes from all other IdPs will have a LoA value of 1.…”

CAFS: A Framework for Context-Aware Federated Services

“…The IdP component also shares the same back-end database of the PAS to retrieve static or dynamic attributes during the user authentication phase. The PPIdP can be integrated with the SP using the concept of Dynamic Federation to create the federation in a dynamic fashion [23]. Such a federation involving the PPIdP is called the Personal Identity Federation (PIF) [22].…”

“…The middle IdP in this setting is known as the Proxy IdP and is assumed to be fully trusted by the SP with a mutual trust agreement. On the other hand, the PPIdP will be considered as a semitrusted entity (not fully trusted by another entity, see [23]) by both the proxy IdP and the SP following the condition of the dynamic federation as explained in [23].…”

Towards Automated Trust Establishment in Federated Identity Management

“…This standard set of attributes is relatively stable, but it can evolve over time to meet the changing needs of the federation members. The trustworthiness of the federation members is based on a web of trust model which is similar to the PGP trust model [16]. This allows existing federation members to dynamically introduce new federation members based on their collective recommendations.…”