Microsoft Releases Open Source Identity Framework

Reading through Peter Bright’s excellent write up of the announcement and framework at Ars reminds me very strongly of earlier research done by IBM in this space, with their Higgins trust framework. In short, the idea is to provide means for safely sharing private data, ideally not revealing any more than necessary to drive a particular transaction.

Beyond the wealth of detail Bright digs out, he also links to an hour long presentation by Dr. Stefan Brands who created the framework, U-Prove, and a free book available for download. Identity is an area where I actually am impressed with the caliber of talent Microsoft has been able to attract and the interesting research they have produced. As Bright points out, this hasn’t always led to successful products, but that doesn’t diminish the thought leadership in the space.

U-Prove is not likely to succeed in the wild much better than its predecessors, at least initially. The article has a pretty clear explanation of the chicken-and-egg problem, or reverse network effect, that has to be surmounted first. I am more optimistic than the author, though, as we have a few examples that have managed this difficult feat–OpenID and OAuth.

My other concerns, about Microsoft using a promise instead of a license or grant, are tempered by the very clear nature of the Open Specification Promise as irrevocable. The SDKs being provided also use a very permissive BSD license. The languages supported aren’t necessarily the best to help with techie adoption, C# and Java, but may provide fodder, if there is sufficient interest, to re-implement in other languages.

Leave a Reply

Your email address will not be published. Required fields are marked *