A forthcoming XML-based standard is living a double life. It is expected to foster integration of current provisioning and identity management software now and will evolve to support Web service in the future.

The proposed standard is the Service Provisioning Markup Language (SPML) 1.0, which is set for ratification Oct. 31 by the Organization for the Advancement of Structured Information Standards (OASIS).

The 1.0 specification is designed to help network executives break the logjam that holds back interoperability among current provisioning systems. These systems let companies automatically set up and deactivate user accounts across corporate networks and applications.

But critics, namely IBM and Microsoft, say SPML in its 1.0 form lacks features beyond simple addition and deletion of users. They say it's not flexible enough to integrate into the palette of Web services standards they are developing, known as WS-* (pronounced WS-Star), which includes WS-Security and WS-Federation.

The two companies are working with OASIS to correct those shortcomings.

The protocol, therefore, appears to satisfy short-term corporate needs while creating a starting point for developing a long-term solution that will work within Web services deployments.

"What this means is that SPML 1.0 will not become the be-all and end-all provisioning standard," says Daniel Blum, an analyst with Burton Group. "Something else will come along." He says Microsoft and Web services standards partner IBM, which last year acquired provisioning vendor and SPML co-creator Access360, have valid points on the long-term viability of SPML.

"But provisioning could take years to work out in the Web services framework, so why wait for interoperability between traditional provisioning systems and applications," he says. "We should not let 'best' be the enemy of 'good.' Companies need something now, so SPML 1.0 is a good first step."

It's a good first step because today different provisioning systems can't talk to each other. That fact makes it difficult to link multiple provisioning systems across business units or with business partners, a nagging issue in large corporations, according to Burton Group.

Provisioning systems also use proprietary technology to talk to the target systems on which they want to set up or deactivate accounts, which forces companies to use custom connectors from each target system to the provisioning system.

SPML 1.0 will foster interoperability on both fronts and let companies focus on the business rules for provisioning user accounts and not on the technology to wire everything together.

The interoperability SPML fosters was demonstrated in July when 10 vendors - BMC Software, Business Layers, Critical Path, Entrust, MyCroft, OpenNetwork Technologies, PeopleSoft, Sun, Thor Technologies and Waveset Technologies - held an interoperability test to show the addition and creation of users across their provisioning systems.

"Enterprise architects should start to consider SPML as real, deployable and valuable," says Darran Rolls, chairman of the Provisioning Services Technical Committee (PSTC) at OASIS and director of technology for Waveset.

What's also becoming real is the relationship between SPML and the Security Assertion Markup Language (SAML), an XML-based standard for exchanging user authentication and authorization data across corporate systems that OASIS ratified in October 2002.

Whitepapers

• Selecting Effective Virtual Directories
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users
• IT Departments on Data Security: A Research Concepts Survey
• Laptop Security Tool Helps Allina Hospitals Track 97% of IT Assets

View more SOFTWARE whitepapers

Webcasts

• Managing the End User Experience-A Real World Example of Success
• Lowering the Cost of Email Archives
• Google Webcast: Why archive email? Top challenges and best practices
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SOFTWARE webcasts

Special Reports

• Application Performance Management Executive Guide
• Executive Guide: Building a Service Oriented Architecture
• IT Buyers Guide To: Collaboration

View more SOFTWARE special reports