Posted March 17th, 2008 James has provided me more to work with…
Identity consolidation says that I figure out how to get user stores out of my enterprise application and instead get these applications to bind at runtime to a directory service such as Active Directory.
Ah, so identity consolidation is centralized authorization. Got it.
I am making the assumption here that when James says user store he means authorization store. (Applications in this model still need some modicum of a user store if nothing else for auditing purposes.) I am assuming the implication here is that after authentication comes a round of authorization that the directory service provides. The application would consume this authorization data, at runtime, and act accordingly. Theoretically, an enterprise policy (XACML) store could theoretically reproduce the authorization models of every application in the enterprise today and that policy tools would interact with this store. Though I think this is a very viable model for customer applications (especially J2EE and .NET), I do not see it as an enterprise approach where complex applications like mainframe security and ERP roam free.
Identity management says that I should go create a strategy around provisioning of identity and leverage tools such as Sun’s IDM, Thor, etc where I still fundamentally allow enterprise applications to have their own user stores and takes me down the path of building lots of connectors… [snip] I am of the belief that identity management (provisioning) propagates and encourages an otherwise bad architecture. Continue reading "Considering identity consolidation"...
Posted March 16th, 2008 James recently picked up on my Identity leprosy or identity zombies post and writes:
Ian believes that identity needs brains but falls into the trap of thinking about identity solely from the perspective of provisioning and while avoiding runtime aspects. I wonder if he would blog on why enterprises should consider identity consolidation over identity management?
Before I respond I’d like to get some clarity. James, give me a more to work with and I’ll happily write more. Help me understand that which you are contrasting between “identity consolidation” and “identity management.” Help me understand how provisioning doesn’t have runtime implications.
Posted March 10th, 2008 Jackson, in discussing the demise retrenchment of HP’s identity business, had this little gem:
We talk about Identity 2.0 in the context of Web services and the evolution of digital identity but our infrastructure, enterprise identity “stuff” is decrepit and falling apart. I have visions of identity leprosy with this bit and that bit simply falling off because it was never built with Web services in mind.
Bits falling of, eh? I’ve never heard of someone losing their core directory services because someone forgot to add XACML support. I’ve also never heard off someone loosing an ear because their provisioning system didn’t support SPML v2. Enterprise identity “stuff” is more like a zombie. It lurks in the dark corners of your enterprise. It staggers out at you at inopportune moments. Two other aspects of this ridiculous image that are valid:
- The identity zombie is incredibly hard to kill.
- The identity zombie needs BRAINS!
“They stab with their steely knives…” Once deployed, even in rudimentary forms, enterprise identity systems are amazing difficult to uproot, to kill. Homegrown systems are notoriously tough to maintain as well as replace. Even worse were those early attempts at vendor provided solutions. Before IBM/Tivoli bought Access360, it had Tivoli User Administrator. TUA… one of the banes of my existence. The thing wouldn’t die. The customers who got it running were actually in love the rotting smelly thing. They kept it on a steady diet of scripts (BRAINS!) that served as connector definitions and entitlements all rolled into one. It just ran and ran and ran. From what I heard, early BMC Control/SA customers are much the same. Continue reading "Identity leprosy or identity zombies?"...
Posted March 9th, 2008  I’ve been back about a week from my trip to Pune. Had a great time. The people and food were wonderful. I did get a chance to go on our company “picnic,” a three day jaunt to the beach near Dapoli. Some funny adventures along the way, like a 14 hour bus ride home featuring the bus breaking down on three different occasions. Good times. All in all, I know I’ll be back soon and hopefully have more of an opportunity to explore.
Posted March 4th, 2008 Bob, Lori, and Gerry at Burton Group have confirmed what I had heard only in rumor: HP is effectively pulling Identity Center from the market. It will continue to focus R&D on its existing Identity Center customer but will not be actively seeking new ones.I’d love to have seen what the business case was for HP’s original acquisitions into the space and then the analysis to make this decision. Tough choices.
|
|
what others say