Security Token Service - Revision history

Tom: /* Meme */

2025-12-17T01:49:54Z

‎Meme

Tom: /* Meme */

2025-12-17T01:42:07Z

‎Meme

Tom: /* Context */

2025-12-17T01:37:14Z

‎Context

Tom: /* Context */

2025-12-17T01:33:14Z

‎Context

Tom: /* Context */

2025-12-17T01:26:53Z

‎Context

Tom: /* Context */

2025-12-16T21:37:44Z

‎Context

Tom: Created page with "==Meme== ==Context== Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign...."

2025-12-16T05:52:08Z

Created page with "==Meme== ==Context== **Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign.**..."

New page

==Meme==

==Context==
**Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign.** They were designed to enable *claims-based identity* and federated authentication across web services.

---
Origins of STS
- **WS-Trust Framework (2002–2003)**
STS was defined as a core component of the **OASIS WS-Trust standard**, which extended SOAP-based web services with secure token exchange.
- **Founding Contributors**: IBM, Microsoft, Nortel, and VeriSign engineers collaborated to create the specification.
- **Purpose**: To issue, validate, renew, and cancel security tokens that could be used across different systems, enabling **single sign-on (SSO)** and federated identity.
- **Analogy**: Instead of each application authenticating users directly, applications redirected clients to an STS, which authenticated them and issued a token. That token could then be presented to other services.

<pre>
How STS Works
1. **Client requests access** to an application.
2. **Application redirects** the client to an STS.
3. **STS authenticates** the client (via credentials, certificates, or federation).
4. **STS issues a token** (XML-based, cryptographically protected).
5. **Client presents token** to the application, which grants access.

Comparison with Other Identity Systems

| System | Era | Focus | Difference from STS |
|--------|-----|-------|----------------------|
| **Microsoft Passport** | Early 2000s | Consumer single sign-on | Centralized at Microsoft; not federated |
| **STS (WS-Trust)** | 2002–2003 | Enterprise federation | Decentralized; tokens issued by trusted authorities |
| **SAML** | 2001 | Web-based SSO | Similar goals, XML assertions; STS more general via WS-Trust |
| **OAuth/OpenID Connect** | 2010s | API & web federation | Lightweight, JSON-based, modern evolution of STS concepts |

# Strategic Significance
- **Enterprise Federation**: STS enabled cross-company authentication without duplicating accounts.
- **Foundation for Modern Identity**: Microsoft’s **Active Directory Federation Services (ADFS)** and **Windows Identity Foundation** embedded STS as a core component.
- **Cloud Evolution**: Today, services like **Azure Active Directory / Entra ID** and **AWS STS** are direct descendants of this model, issuing tokens for federated cloud access.
#Takeaway
The **STS server originated as part of WS-Trust**, built by IBM, Microsoft, Nortel, and VeriSign to solve federated identity challenges. It laid the groundwork for modern identity protocols like SAML, OAuth, and OpenID Connect, and remains embedded in today’s cloud identity systems.
</pre>
Mapping modular governance schemas, STS is a perfect historical case: it shows how **policy languages (WS-Trust, WS-Federation)** formalized trust envelopes—exactly the kind of analyzable governance you’re designing for AI agents. **timeline of identity federation evolution** from STS → ADFS → OAuth/OpenID → Entra ID?

==References==

@@ Line 1: / Line 1: @@
 ==Meme==
-For mapping modular, distinct [[Governance]] schemas, STS is a perfect historical case: it shows how policy languages (WS-Trust, WS-Federation) formalized trust envelopes: the kind of analyzable governance needed for AI agents.
+* Also see wiki on  [[Governance Framework]].
 ==Context==

@@ Line 1: / Line 1: @@
 ==Meme==
-Mapping modular governance schemas, STS is a perfect historical case: it shows how policy languages (WS-Trust, WS-Federation) formalized trust envelopes—exactly the kind of analyzable governance needed for AI agents.
+For mapping modular, distinct [[Governance]] schemas, STS is a perfect historical case: it shows how policy languages (WS-Trust, WS-Federation) formalized trust envelopes: the kind of analyzable governance needed for AI agents.
 ==Context==

@@ Line 22: / Line 22: @@
 | System    | Era | Focus | Difference from STS  |
 |-----------|-----|-------|----------------------|
-| **Microsoft Passport** | Early 2000s | Consumer single sign-on | Centralized at Microsoft; not federated |
+| Microsoft Passport | Early 2000s | Consumer single sign-on | Centralized at Microsoft; not federated |
 | **STS (WS-Trust)** | 2002–2003 | Enterprise federation | Decentralized; tokens issued by trusted authorities |
-| **SAML**  | 2001 | Web-based SSO | Similar goals, XML assertions; STS more general via WS-Trust |
+| **SAML**           | 2001      | Web-based SSO | Similar goals, XML assertions; STS more general via WS-Trust |
-| **OAuth/OpenID Connect** | 2010s | API & web federation | Lightweight, JSON-based, modern evolution of STS concepts |
+| OAuth/OIDC         | 2010s     | API & web federation | Lightweight, JSON-based, modern evolution of STS concepts |
@@ Line 35: / Line 35: @@
 The **STS server originated as part of WS-Trust**, built by IBM, Microsoft, Nortel, and VeriSign to solve federated identity challenges. It laid the groundwork for modern identity protocols like SAML, OAuth, and OpenID Connect, and remains embedded in today’s cloud identity systems.
 </pre>
-Mapping modular governance schemas, STS is a perfect historical case: it shows how policy languages (WS-Trust, WS-Federation) formalized trust envelopes—exactly the kind of analyzable governance you’re designing for AI agents.  timeline of identity federation evolution from STS → ADFS → OAuth/OpenID → Entra ID?
+Mapping modular governance schemas, STS is a perfect historical case: it shows how policy languages (WS-Trust, WS-Federation) formalized trust envelopes—exactly the kind of analyzable governance needed for AI agents.
 ==References==

@@ Line 2: / Line 2: @@
 ==Context==
-**Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign.** They were designed to enable *claims-based identity* and federated authentication across web services.
+* Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign.** They were designed to enable *claims-based identity* and federated authentication across web services.
 Origins of STS
-- **WS-Trust Framework (2002–2003)**
+*WS-Trust Framework (2002–2003)**  STS was defined as a core component of the **OASIS WS-Trust standard**, which extended SOAP-based web services with secure token exchange.
-  STS was defined as a core component of the **OASIS WS-Trust standard**, which extended SOAP-based web services with secure token exchange.
+*Founding Contributors**: IBM, Microsoft, Nortel, and VeriSign engineers collaborated to create the specification.
-- **Founding Contributors**: IBM, Microsoft, Nortel, and VeriSign engineers collaborated to create the specification.
+*Purpose**: To issue, validate, renew, and cancel security tokens that could be used across different systems, enabling **single sign-on (SSO)** and federated identity.
-- **Purpose**: To issue, validate, renew, and cancel security tokens that could be used across different systems, enabling **single sign-on (SSO)** and federated identity.
+*Analogy**: Instead of each application authenticating users directly, applications redirected clients to an STS, which authenticated them and issued a token. That token could then be presented to other services.
 <pre>

Security Token Service - Revision history

Tom: /* Meme */

Tom: /* Meme */

Tom: /* Context */

Tom: /* Context */

Tom: /* Context */

Tom: /* Context */

Tom: Created page with "==Meme== ==Context== **Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign.**..."

Tom: Created page with "==Meme== ==Context== Security Token Services (STS) originated in the early 2000s as part of the WS-Trust specification, developed by IBM, Microsoft, Nortel, and VeriSign...."