Why a User Identity Reference Model?

The first part of this week I'm at Digital ID World. That means fewer chances to meet with my co-workers to further develop the model, but hopefully a chance to catch up on blogging where we got to last week.

At DIDW I'm telling a few people about this blog, so hopefully we'll get some more participation soon. A couple people have told me they'd like to participate in the actual discussions we're having, and I think that might be a good idea. I'll check into it to see if we can host a series of telecons.

When I first started this effort, I hoped we could come up with a simple "stack" (like the OSI Reference Model). It wasn't long before we moved to a diagram instead of a simple stack. I still hope we end up with something very simple. As an example, I've seen versions of the following diagram for access control all over the place. I don't know where it originated (if someone can provide a link, that would be nice), but it seems to have very wide recognition, and even if someone hasn't seen it before, it doesn't take them very long to understand. It's a great tool for introducing vocabulary, for categorizing products, and for describing how various systems can work together.




In my day job some of us are working on a suite of roadmaps, including Authentication, Authorization, Provisioning, and Identity. In the Identity roadmap we had hoped to cover many things; however, limited time and resources requires us to trim down to just a few topics, which are listed here:

• Identities & Personas & Principals & Contexts (entities with multiple personas)
• Identity beyond people (applications, devices, etc.)
  
• Standard identifier framework (fully-qualified identifiers from multiple namespaces)
  
• Third party identity & attribute providers (federation concepts)
  

For some of these items I'd like to be able to reference a widely recognized identity model, and then use it to help design my employer's approach to managing multiple personas, testing IDs, special IDs (like IDs for crawlers), elevated privileged accounts, application identity, etc. After failing to find such an existing model, we started this activity to build one. Hopefully we can define it in a generic fashion so that it can be useful far beyond the specific needs of my employer.