This year's Kuppinger-Cole European Identity Conference confirmed that many of the players in the identity market are now trying to work more closely to improve future technologies and increase their uptake. The conference centered around 'the Cloud', a rather nebulous term for services provided over the Internet. As expected, discussions focused on security issues and on ways in which identity data could be leveraged to improve business in an environment where data is becoming increasingly distributed. In summary, it was apparent that, while some areas of contention regarding security have been settled by agreeing that different protocols should be used to achieve different ends, there are still many issues which need to be resolved.

As for improving revenue and management in the identity sphere, things seemed a lot more vague, and mostly hinged on the hope that businesses would come to see the benefits of these technologies on their own. This was most evident in a talk about Identity Cards, where roll-out approaches vary widely. The German approach enforces compulsory enrollment but offers services to businesses that may help reduce infrastructure costs, while the Swiss approach pushes the business cases for uptake but allows for voluntary adoption. Although some interesting ideas about potential ways the technology could benefit businesses were presented, it will only become clear over time whether businesses actually see these benefits.

Perhaps the most positive aspect of the conference was the impression that many of the big players in the market are trying to work together toward a common goal. However, opinions are still fairly divided, and I was somewhat concerned to observe a few high-profile players in the industry suggest that identity federation through SAML (and, in particular, the work that Liberty Alliance has done, now continued by Kantara Initiative) looked like it would die in the water. This thinking is a little uninformed and, when chatting with other visitors to the conference, it was good to hear that SAML is ubiquitous in the Australian education sector and is widely used across Sweden as well as Denmark in various other governmental sectors.

This confidence in SAML was certainly reflected in a talk by Fulup Ar Foll, who accepted that while OpenID had won ground in the Web 2.0 space, SAML is the natural choice in the commercial and enterprise sphere, as is InfoCard for user interfacing and identity selection. This unofficial armistice between competing technologies has allowed the market to move forward, and everyone in the identity market seems to agree that authentication is a necessary evil, but not the end goal. Now that we have settled some differences over the roles that these technologies play and the arenas in which they belong, we can start looking toward ways that they can enable other identity services to provide real and tangible benefits for businesses and consumers.

Although touted as an 'experts conference', it is clear that the real goal was to educate potential customers and vendors about new identity technologies. Actually, many of these technologies are not really that new. As already mentioned, the Liberty Alliance federation technologies have been developed over the last 10 years or so, and InfoCard has been in development for almost as long. Instead of explaining the practical usage of many of these technologies and demonstrating them in action, the conference speakers still discuss them in a very theoretical way. In talking to many of the integrators and visitors attending the sessions, I sensed that there was a general frustration with this tendency to keep to the theory and to continue talking about the future. Integrators felt that there was little focus or guidance on how to handle the very real problems that they face today, and that all of this looking toward tomorrow (when things will be much better) was not genuinely helpful.

A few of the visitors seemed overwhelmed by the sheer mass of acronyms, protocols, and jargon that was being used. Perhaps it would be fair to say that this type of conference is simply not geared toward people who lack an understanding of the basic theory already out there - but if one needs to be grounded in theory to really understand all of the talks, then there should be little need for the talks to remain theoretical. As an industry, we really need to be careful of not simply 'blinding our consumers with science'.

There seems to be a genuine need to balance conferences like EIC with some advisory workshops where integrators, developers, and architects can learn how to begin working in a direction that will help resolve current issues in a way that won't paint them into a corner in the future. I attended the Authentication and Authorization track entitled 'How to make your software security architecture future-proof' which was presumably intended to have precisely this effect. The panelists pushed the work they were doing and suggested moving away from connection-based authentication and a 'pull-based' identity infrastructure. However, there was little guidance on how to actually achieve this, or how to work it into an existing architecture that more than likely would be built around these types of technologies. The obvious time limitations in a big conference make it difficult to move beyond a high-level schematic of what these technologies involve and into any deeper discussion, so it is hard to be very critical of this. However, it may help to garner support if we can show practical examples of how these technologies are solving problems right now. Indeed, this was highly evident in the talk on OpenID development being done at Microsoft, where we were able to see a prototype solution to many problems using OpenID, as it currently stands, in action. More kudos to you, Ariel Gordon.

To illuminate my perspective for these comments, I'll note that Symlabs has an interesting history. Our core product is designed to resolve many of the immediate issues associated with distributed identity data and connection-based authentication. Much of our software is built around the theme of dealing with problems that people face today. Over the years, particularly through our involvement with Liberty, we have also genuinely explored future technologies. We built Symlabs Federated Identity Suite around many of these concepts. In this way, we have attempted to maintain a presence in both arenas. But one thing is clear to us - while interest in federation is slowly picking up, the majority of our customers are looking to solve today's problems today.

EIC 2010 in Munich was a great opportunity to meet some new people and catch up with many other familiar faces. It was interesting to see how many of the issues that used to be so divisive are now playing out, and it was a genuinely positive experience. I just hope that, when the next one comes around, the experience is a little less ethereal and we see a bit more of an effort to address the problems in existing infrastructures so it can match up to the forces driving these technologies.

Rowan Puttergill