Why HP Bought Into Federated-Identity Management

Hewlett-Packard's decision this week to acquire Trustgenix, one of the few remaining independent suppliers of federated identity-management software, will give it and its partners a key tool for cross-domain access management and authentication.

Though the companies declined to disclose terms of the deal, it was hardly a surprise to those watching HP's software business closely in that the company already was licensing Trustgenix' IdentityBridge software. The server-based tool provides standards-based federated identity management, including single sign-on capability to multiple identity-management and authentication systems.

"They were able to try on the technology and see if it would fit well in their suite. Once they realized it was a good fit, they just went and made it official," says Mike Neuenschwander, research director for the identity management practice at the Burton Group, a Midvale, Utah-based consultancy.

There is growing demand for federated identity-management solutions as a way to allow enterprises to provide cross-domain authentication and secure-access management, key for those who let business partners, suppliers and customers access any of their systems. An airline, for example, may have partnerships with hotels and car-rental companies. Using a federated identity-management solution would allow a customer to login to one system and have his credentials shared across the various domains.

By acquiring the technology, HP intends to integrate it with its other software offerings, including OpenView and the telco software-management solutions, says Sai Allavarpu, director of product management and marketing for security and identity.

"Federation has been one of the high growth areas for providing various security services," Allavarpu says.

Neuenschwander says Trustgenix was seen as an acquisition target, and had a rival such as CA made such a move, it might have been detrimental to HP, the only major vendor that didn't own a federated-management platform. IBM, Novell, RSA and Sun Microsystems all had their own, while CA acquired Netegrity, Oracle bought Oblix and Phaos, and BMC Software recently picked up Open Network.

Meanwhile, Microsoft is expected to raise the bar with federated-management software this month when it releases its long-anticipated Windows Server 2003 R2 software. The two-year upgrade to its server OS will include Active Directory Federated Services, or ADFS, which will enable basic single sign-on to at least some systems, Neuenschwander says.

"It will essentially make this a mass market thing because it's available in the platform," Neuenschwander says of Microsoft's ADFS. "Even though its not as fully featured as what's available in Trustgenix, it will create a network effect because everyone will be able to federate at some level."

Trustgenix has the most robust support for all of the federated identity management standards, he adds.

Trustgenix is not the first identity-management acquisition HP has made. The company acquired the Select Access assets from Baltimore Technologies two years ago. Like other software acquisitions, the Trustgenix assets will fall under the OpenView brand. HP for the first time turned a profit on its software business last quarter.