It seems the Web API authentication discussion has been sparked up all over the Web by the various announcements of Windows Live ID and the Google Account Authentication for Web apps . In his blog post Google's authentication vs. Microsoft's Live ID Eric Norlin writes
Recent announcements of Google's authentication service have prompted comparisons to Passport, and
even gotten to Dick Hardt (of "Identity 2.0" fame) to call it the, "deepening of the identity silo." I'd
like to contrast Google's work with Microsoft's recent work around Live ID.
Microsoft's Live
ID *is* the old Passport — with a few key changes. Kim Cameron's work around
the identity
metasystem has driven the concept of InfoCards (now called CardSpace) deep
inside of Microsoft. In essence, Kim's idea is that there is a "metasystem"
which utilizes WS-Trust to translate tokens, so that all identity systems can
interact with each other.
Of extreme importance is the fact that Windows Live ID will support WS-Trust,
WS-Federation, CardSpace and ADFS (active directory federation server). This
means that A) Windows Live ID can interact with other identity metasystem
implementations (Open Source versions, for example); B) that your corporate
active directory environment can be federated into Windows Live ID; and C) the
closed system that was Passport has now effectively been transformed into an
open (standards-based) and transparent system that is Live ID.
Contrast all of this with Google's announcement: create Google account, store
user information at Google, get authentication from Google — are we sensing a
trend? While Microsoft is now making it easy to interact with other (competing)
identity systems, Google is making it nearly impossible. All of which leads one
to ask - why?
Perhaps it's because there are now so many old-school Microsoft people at Google? ;)
On a more serious note, I suspect that the Google folks simply didn't think about the federation angle when designing the authentication model for their APIs as opposed to this being some 'evil plot' by Google to create an identity silo.