Obviously, Identity should be the BO but you can't perform this action as we don't have password field released and to my knowledge, SAP would never that 
They would rather release a webservice that authenticates and manages stateful communiucation like SFSF. May be! But, there is nothign I see at the moement.