Scaling a federated identity infrastructure

Different kinds of organizations approach the problem of scaling a federated identity implementation in different ways. When you’re federating with one or two partners, hammering out the legal arrangements and assigning risk and liability is done one partner at a time. Even if technology standards provide universal system interoperability, the lawyers are likely to approach each agreement as a one-off task. Let’s call this model “peer-to-peer federation.”

The mobile phone industry has had plenty of experience with this kind of federation. Timo Skytta, director of Web services at Nokia, says, “Federation is nothing new for mobile phone companies. Roaming, for example, works because there’s an underlying technology combined with a set of business agreements that spell out issues like who is responsible for paying.”

According to Skytta, mobile phone carriers have an advantage over other verticals because many of the agreements and issues involved with federation have already been worked out. Mobile carriers still work mainly through p-to-p relationships, but they use standardized agreements as a starting point. These agreements, worked out by industry consortiums such as the GSM Association, give mobile companies a head start in a negotiation.

But if you’re not in a vertical that has model agreements, or if you’re federating with partners outside your vertical, the p-to-p approach can become tedious. Scaling to more than a few partners begs for more efficient governance models.

One way to scale up is using a hub and spoke model. Hub and spoke federations happen when one dominant player in an economic ecosystem (the hub) starts creating standard agreements with each of its partners (the spokes) and enforcing them through economic muscle.

Hub and spoke patterns can work well in certain situations: a large manufacturer and its suppliers, for example. The suppliers don’t usually have an incentive to federate with one another because the hub -- the manufacturer -- represents the dominant business relationship for each. Thus, the hub sets the standards and creates the standardized agreements.

The hub and spoke model is a natural fit for internal federations. In these situations, the CIO’s office can act as the hub, creating standards and agreements in consultation with the various business units. Intercompany federations can be trickier, however, as hub and spoke governance is likely to advantage the hub, which holds the power, over the spokes. Under these circumstances, the companies at the periphery of the system may chafe, and disputes are inevitable.