Trustgenix takes aim at ID management complexity

Federated identity isn’t just a good idea, it’s the Way It Should Be, according to anyone working with a sizable extranet. The need for partners and edge sites to retain control over their local directories — coupled with the need to provide centralized applications — is quickly losing the obvious catch-22.

Deploying federated identity solutions to edge sites within an organization or to franchise partners has been possible for some time. The actual deployment, however, can take substantial time and money due to varying edge-site configurations, lack of suitable skills, and the relative complexity of most federated identity solutions.

Trustgenix IdentityBridge Standard Edition takes care of that complexity by focusing on the edges of a federated-identity deployment. Trustgenix isn’t reinventing the wheel with this release, but it has definitely lowered the profile.

One-sided solution

At its simplest, IdentityBridge Standard Edition is a GUI installer that accurately configures a site as an IDP (identity provider) and creates a URL that is then included on an intranet site to access the application residing at the SP (service provider). The whole installation is completed via a wizard that requires only a few clicks and basic information; it might take a few minutes on the phone to walk a neophyte through the installation from start to finish.

IdentityBridge is a wrapper around Trustgenix’s larger IdentityBridge Enterprise Edition, with many features removed. For instance, you cannot use IdentityBridge Standard Edition as an SP because it does not provide for inbound authentication.

So, in practice IdentityBridge Standard Edition provides only one side of the equation. That’s quite all right, however, because the vast majority of federated identity deployments find themselves with one hub and many spokes.

The fact that IdentityBridge Standard Edition is relatively crippled doesn’t mean it can’t be configured beyond the simple point-and-click installer. The installation can be modified through a Web-based administration interface. You can then configure custom assertions to be passed to the SP, construct custom URLs to be placed on an intranet site, and so forth.

In the lab, I built a new Windows 2003 Server and a Windows 2000 Server, each configured as an Active Directory domain controller for a unique forest. I also installed IIS on both. For my purposes, Trustgenix provided me with a log-in to a lab server at its facility that was running Trustgenix IdentityBridge Enterprise Edition, so I was able to drive both sides of the partnership.

I created a few test users in each domain and began installing IdentityBridge. The installation went through on both platforms with little hassle, although at the end of the process there can be significant pauses during local database initialization. This step took more than 5 minutes in the lab but is highly dependent on local server resources.

After I installed the application, a browser window appeared, pointing to the local administration page. IdentityBridge is written wholly in Java, and the Web interface is no exception. The installation places a local copy of Tomcat on the server to drive the JSP administration pages.

After logging in to the administration site, you create a partnership by providing a name for the connection, creating a local metadata file, and either browsing to a local metadata file for the SP site or entering a URL to a hosted metadata file on the SP site. E-mailing the local XML metadata file to the SP completes the circuit.

When the federation was functional, I created a URL pointing to the application residing at the SP site and logged in without any issues. Including installation time and the 5-plus minute pause near the end, the whole installation took less than 30 minutes from zero to federation. Impressively simple.

Federated finesse

The IdentityBridge Web interface takes some time to get used to, but because the focus here is a one-time configuration, it’s more than adequate. Although my tests used Trustgenix identity products on the SP site, Trustgenix claims full compatibility with any standards-compliant identity products on the market.

Currently, IdentityBridge Standard Edition handles the SAML 1.0 and 1.1 and the Liberty Alliance 1.1 and 1.2 identity standards. Trustgenix promises full SAML 2.0 support this summer, and it demonstrated SAML 2.0 compliance earlier this year.

IdentityBridge Standard Edition’s lack of SP features, limited OS support, and capability of connecting to only a single SP site are truly limiting but largely irrelevant given the product’s focus on small edge sites. For enterprises built with this model, IdentityBridge Standard’s $5,000 price tag and extreme ease of installation are compelling.

But it would be nice to see scripted or configuration file-based installations. The ability to ship a CD with the IdentityBridge Standard code, the license key, and an XML file with the appropriate SP configuration already prepared would also be a major benefit and would even further reduce the configuration necessary on the edge.

Obviously, IdentityBridge Standard Edition isn’t designed to be anything more than a spoke to a larger hub. Overall, however, the simple installation and configuration — coupled with its broad support and low cost — make this federated-identity solution a winner.