SAML 2.0 Enables SSO Products to Work Over the Web

Published: March 15, 2006

by Alex Woodie

Even before OASIS had a chance to officially ratify the new Security Assertion Markup Language (SAML) 2.0 Monday, several vendors were already shipping new products that supported the new security protocol, which is expected to allow single sign-on (SSO) and identity management systems that were previously confined to intranets to be used across the Internet in new ways.

One of the first vendors to announce a SAML 2.0-based product was Oracle, which unveiled Identity Management 10g Release 3 back in February. This product, which supports SAML 2.0, Liberty ID-F, and the WS-Federation protocols, can provide SSO capabilities for users logging onto its Oracle E-Business Suite, as well as its PeopleSoft Enterprise and J.D. Edwards products, and applications from rival SAP.

Another vendor supporting SAML 2.0 is RSA Security, which announced Monday its Federated Identity Manager 3.0 that runs on Windows, Linux, and Solaris. The security software vendor says support for SAML 2.0 within the product, as well as support for Liberty Alliance ID-FF and Shibboleth specifications, will "greatly expand" the potential for interoperability of authentication-related data, including working with competing identity management software vendors. Federated Identity Manager 3.0 will ship during the second quarter.

Another vendor shipping a SAML 2.0-based product in February was Computer Associates' with its eTrust SiteMinder software. Like RSA's product, eTrust SiteMinder supports the SAML standards, as well as the Liberty ID-FF 1.2 and the Shibboleth standards. The new software should ship this summer.