federated access or federated identity?

Understandably over the last couple of years there has been a slow shift in the access management community to talk more about identity management than access management. The two definitely come hand in hand, but I think we need to be careful about what we actually mean when we use the terms. A trend has started which takes the term federated access and replaces it wholesale with federated identity. I think this is a mistake, as I think the two are actually very different things.

Federated access is all about allowing disparate systems to make use of the same access credentials. It makes use of identity information to ensure that the correct authorisation decisions are made – but at the end of the day its primary focus is on ensuring that users are effectively connected to the resources and services that they require access to.

The entry on wikipedia for federated identity is interesting:

In information technology, federated identity has two general meanings:

• The virtual reunion, or assembled identity, of a person’s user information (or principal), stored across multiple distinct identity management systems. Data are joined together by use of the common token, usually the user name.
• A user’s authentication process across multiple IT systems or even organizations.

I don’t agree with this. I think the first point describes federated identity very well. I think the second point describes federated access. The main difference is that federated access as currently used tends to a) rely on one identity source and b) focuses on access provision rather than identity information. A federated identity system should take us in to the world of multiple identity sources providing both access and identity solutions – such as managing personalisation features, loyalty schemes, recommmendations etc.

Whilst we have federated access in place within the UK, federated identity is definitely the next step. We need to be able to allow users to call identity information from different places and we need to be able to effectively combine user-managed identities with affiliation-managed identities. Technologies like Information Cards are an interesting step on this path – but are still complex for end-users to navigate. I still think there is a different technological solution around the corner that may help us more effectively tackle this challenge…and will wait with interest to see it!

In the meantime, don’t forget that JISC is looking for projects under its latest innovation call. These could tackle both federated access and federated identity and who knows, may produce that illusive new direction!