TUESDAY, March 4th. Chicago, back to freezing temperatures.
Microsoft's Stuart Kwan kicked off the second day with his keynote address where he spoke about an "identity bus", where off-the shelf applications can plug in for all their authentication and access control needs. It was exciting to hear this from Microsoft. The concept is actually not even that new - Phil Windley wrote about this in his book "Digital Identity. But it's great to see that Microsoft seems fully committed to (several selected) open standards (most of them likely to start with the letters W and S) and interoperability, and assuming that this stays that way, I agree with Stuart that "it does not seem as far off as you might think". His vision is that claims, or "assertions" in SAML-speak, are the core of identity data within the bus that can be transformed into different formats depending on application needs. Somehow I had a quick excursion down memory lane during the end of the presentation to a place in time a few years ago when I was briefly involved in a project for a large service provider who had deployed two web application environments. One of them was called the "Microsoft Environment" and the other one was called the "Open Environment". I remember that they had quite a challenge getting identity management to work across both environments at that time. So in future, that unnamed company will just have one "Open environment" that includes all the Microsoft web applications as well. :-)
Later on in the exhibition area I took a closer look at the latest virtual directory server product that had just been announced a day previously by a company called "Optimal IDM". I was given a comprehensive tour by chief software architect Nada Dickerson who graciously let me monopolise her for an extended period (I couldn't help it, coming from the virtual directory space, this really peaked my interest). Optimal IDM has deployed identity management solutions over several years and has run into the same types of issues over and over again, which led them to develop their virtual directory product. The product is specialised to handle three specific "modes". The first mode is called "Union Mode" and aggregates unique entries from multiple containers into a virtual consolidated view. The other two modes are variants of this, and add join rules. Object Precedence Mode can be used to specify which back-end has the precedence when the same object exists in multiple back-ends. Attribute Precedence Mode can additionally join attributes from the same object in multiple backends so that the returned object contains data from all objects of the same name. This is essential the "shadow joiner" or "data augmentation" feature found in competing products. Optimal IDM has developed their virtual directory product entirely with .NET technology and believes this to be a competitive advantage over other virtual directories.
Even before the conference, I had already earmarked the slot at 11 AM for Pamela Dingle's presentation entitled "Hanging Out in the CardSpace Kitchen". I hadn't met Pamela before, but read some of her excellent material on the subject. It turned out exactly as I had hoped - an excellent, educational and lively presentation from *the* authority on CardSpace (apart from Microsoft's Kim Cameron, of course). She also made the connection clear between Microsoft's implementation, Project Bandit and Project Higgins. Microsoft's Brian Puhl chimed in at the end to give an excellent scenario on how CardSpace can be used to work around some tricky legal issues in federated environments.
I remembered Dave Kearns mentioning in one of his posts from way back when that when Pamela Dingle presented on CardSpace at one of the Digital ID World conferences, she had Microsoft employees clamoring to ask questions. Well they didn't do this time, but I certainly did. I met Pamela again that night in Centrify's hospitality suite at a virtual bowling tournament on a Wii. Both Pamela and I were new to the Wii and immediately noticed that it even offers its own variety of "InfoCards" in the way of avatars (pictures) of the participants that our host configured for us. :-)
Another highlight was the BoF (birds of a feather session) on ADFS that I attended. Stuart Kwan and Brian Puhl were there as well, and shared some interesting details on why we actually need to use claims and can't just instead stick additional identity information in a Kerberos token (some applications would just choke on that), as well as throw around some ideas on how home realm discovery could be used in an environment where multiple federation protocols are used. Then suddenly we were all deep into CardSpace again. Stuart also offered a very interesting opinion how internal security tokens might look like in a hypothetical, futuristic Windows version. Unfortunately I had to run out because I had an appointment, but I think the BoF ran well over its allocated time - definitely another DEC highlight.
Against good judgement and to the bewilderment of my bowling buddies at the Centrify hospitality suite, I decided to forego the invitation to Oxford Computer Group's party featuring a band called "Hairbanger's Ball" and instead head off to early retirement for the day. In hindsight this was not the smartest thing to do, because it must have been a real blast, and overall the particular session in the morning that I wanted to attend was cancelled. Well, I'll know better next time! :-)