Sun converts Web SSO authentication to open source

By Anne Saita, News Director 13 Jul 2005 | SearchSecurity.com

Digg This!     StumbleUpon     Del.icio.us

SAN DIEGO -- Sun Microsystems Inc. today announced it will turn over the code for its Web-based single sign-on authentication technology to the open source community.

"Open sourcing is not about giving code away for free," said Sun Executive Vice President John Loiacono in announcing the initiative at the Burton Catalyst Conference here. Instead, he said the company was releasing the source code for WebSSO under Sun's Common Developer and Distributed License program to stir community and innovation in the Web and identity management arena. This also allows Sun to help decide which innovations are worth testing for further development. "What we're trying to do is change the level of the conversation."

Immediately following the announcement, users expressed tempered enthusiasm, believing developers will enjoy digging through the code and finding ways to improve its use as an authentication tool, but also wondering if there's a catch. Some openly questioned whether this was more of a marketing ploy to help Sun seed more products and visibility in the marketplace since releasing WebSSO, to now be known as Open Source Web Single Sign-On, to a broader audience could also help push other ID management tools in its arsenal.

Loiacono emphasized during his session that Santa Clara,Calif.-based Sun wasn't dropping its proprietary rights because the technology, part of its Java System Access Manager software, had lost its value. "This is a revenue-generating product for Sun," he said. "This is no different than what we did with Solaris. It's from the same tap."

To gain a competitive edge against the Linux and Windows operating systems, Sun last month announced it would turn over code from its Solaris operating system to the open source community. OpenSolaris includes the core OS, system libraries and commands. The software giant followed that feat by forking over code for its Java System Application Server Platform Edition 9.0 and the Java System Enterprise Server Bus (ESB) at the recent JavaOne conference.

Loiacono said Sun will continue to support WebSSO and foster community-building through open-source forums designed to examine and enhance the code.

"We anticipated the move," noted Michael Blackin, chief security architect for Oracle Corp., "and it re-enforces to us that single sign-on as a component of identity management is a commodity, and that the real value that people get is out of the identity administration side."

Documentation and sample code is now available on a Sun Web site. The full code will be available in early 2006.

Tags: Enterprise Single Sign-On (SSO),  Enterprise User Provisioning Tools,  Web Authentication and Access Control,  Password Management and Policy,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Enterprise Single Sign-On (SSO) How to log in to multiple servers with federated single sign-on (SSO) Security on a budget: How to make the most of authentication tools Best Identity and Access Management Products Changing times for identity management Kerberos configuration as an authentication system for single sign-on How to use single sign-on for Web access control to prevent malware Learn about enterprise strategy for server virtualization single sign-on Enterprise single sign-on: Easing the authentication process Exploring authentication methods: How to develop secure systems User provisioning and SSO for PeopleSoft- and Unix-based products Enterprise Single Sign-On (SSO) Research Enterprise User Provisioning Tools Quiz: Compliance-driven role management Identity lifecycle management for security and compliance Content-aware IAM: Uniting user access and data rights Is Identity Management as a Service (IDaaS) a good idea? Top tactics for endpoint security How to edit group policy objects to give a user local admin rights Privileged account management critical to data security Making the case for enterprise IAM centralized access control Lesson 3: How to implement secure access Best practices for a privileged access policy to secure user accounts Web Authentication and Access Control Group to shed light on secure identity management threats IT business justification to limit network access How to confirm the receipt of an email with security protocols Schneier-Ranum Face-Off: Is Perfect Access Control Possible? Kaminsky reveals key flaws in X.509 SSL certificates at Black Hat Changing times for identity management How to use single sign-on for Web access control to prevent malware IBM USB banking device stops keyloggers, malware Can mutual authentication beat phishing or man-in-the-middle attacks? Could someone place a rootkit on an internal network through a router?

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary onboarding and offboarding  (SearchSecurity.com) single sign-on  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary