Towards Improved Federated Identity and Privilege Management in Open Systems

The ability to federate identity across organizations while maintaining access rights and privileges poses a major challenge [5]. The solution is federated identity and privilege management. However, almost all well-known such schemes have their drawbacks. Additionally, the development of Web-based federated identity solutions has advanced more rapidly as compared to the Web-based privilege management mechanisms, resulting in a wide gap in integrating privilege management with existing federated identity mechanisms to provide a comprehensive access management solution. We discuss these challenges, namely the shortcomings of federated identity mechanisms, and their integration with privilege management mechanisms. In response, we present an integrated approach to federated identity and privilege management specifically designed for Web-based platforms. 2. Related Research and Challenges The concept behind federated identity and privilege management mechanisms derives its motivation from classical authentication and authorization protocols. Traditional approaches [11] used identity-based credentials issued by a centralized server. Such schemes have scalability problems in distributed systems. Alternatively, various schemes emerged for distributed authorization using capability-based credentials. Notable amongst them are RFC 251, [4, 6, 7], which are based on the Publi