Yesterday Facebook developers posted a blog about Facebook's support for OpenID as a relying party http://developers.facebook.com/news.php?tab=blog. This is a great example of a consumer oriented use of identity federation and another sign that the concept of sharing of a user identity between separate domains is alive and well.
However given the collision of consumer IT and enterprise IT (think iPhones in the enterprise, enterprise users who say "my home laptop is 10x better than my corporate issued laptop," or people who are leveraging LinkedIn to research job related questions), this also raises certain interoperability warning signs as there are currently three viable technology approaches to federating identity on the Internet: OpenID, SAML, and Information Cards (see the Venn of Identity paper which describes, compares, and contrasts these technologies http://www.xmlgrrl.com/publications/IEEESecPriv-MarApr2008-MalerReed-Venn.pdf). What happens when consumer users start to expect to use their OpenID for access to more sensitive Web sites? Do enterprises get put back in the mode of trading off security for convenience?
It currently looks like all three approaches to sharing browser sessions across the Internet will continue to thrive in the coming years. So are we just laying the foundation of identity incompatibility of the future? Obviously I hope this is not the case. In fact avoiding this consumer vs. enterprise future is one of the key reasons that CA took an active part in kicking off the Kantara Initiative (www.kantarainitiative.org), to help drive interoperability and cohabitation of these three federation technologies, and to address the meta-issues that are common to all federated security relationships, such as trust, contracts, liability, and privacy.
My bottom line ... I think it is great that Facebook is now a federated relying-party, as this further shows the value of Web-based, identity-aware, federated collaboration. But of course with every positive often comes future challenges.