A Pattern Language for Identity Management

The development of software has recently changed significantly. With the ubiquity of computing, users may need to access a wider range of applications, which may not know them in advance. Thus there is a need for dynamic trust establishment and identity exchange protocols and whatever security model is used must support these aspects. As a way to make these concepts more precise and concrete, we define architectural patterns for identity management. These patterns can then be used directly in the software development cycle, as proposed by different methodologies. The Identity Provider pattern centralizes the administration of a security domain's subjects. The circle of trust pattern represents a federation of service providers that share trust relationships. The identity federation pattern allows to federate multiple identities across multiple organizations under a common identity. This pattern relies on the SAML assertion pattern, which provides a unifying format for communicating identity information between different security domains.