Monday, April 28, 2025

Must it always be Virtual?

 

The only constant in life is change

-Heraclitus. 



One of the things that most people in the Identity field know about me is that I am a huge fan of Virtual Directory Services (VDS). But it’s possible this is starting to change. It’s also entirely possible that working with the technologies at Ping Identity every day has something to do with this. 1


What I have always loved about a true Virtual Directory is its immediacy. Access the VDS, have it do the lookup, and then do something with the value. It doesn’t matter what the back end is—an LDAP directory, a database view, or even a CSV file. (Not that I ever wanted to go there.) Do the search, get the result, and move on with your life.


But do we really need this when other, less complicated tools exist? I’m starting to think that this is exactly what is happening. Let’s face it: a Virtual Directory is a real pain to set up in the posterior (although once it’s running, you tend to forget it’s there). Setting up the DIT, configuring joins of back-end sources, properly translating non-directory data into something resembling the DIT that was configured back in step 1, it's tedious and is about as error-prone a process as exists in the Identity field.


What if I told you that there were solutions that just work better?


I mean, if you just need to do some basic representations of an existing Directory and some simple transformations to handle things like mergers and acquisitions, a basic LDAP Proxy will handle this exceptionally well. There is no need to have anything else going on. A proxy also handles essential use cases such as Pass-Through Authentication, which can be helpful during “lazy migration” scenarios.


If you need to access different types of data, we need to think about what are we doing with it. Does it really need to be referenced in some sort of LDAP schema? Does inetOrgPerson (or other LDAP Object classes) necessarily give any true advantages? Most of the time when we need this information it’s to choose a course of action during an identity related process.


What are we doing with it? Does it need to be referenced in some LDAP schema? Does inetOrgPerson (or other LDAP Object classes) necessarily give any actual advantages? Most of the time, we need this information to choose a course of action during an identity-related

So, instead of the virtual attribute, why not consider fine-grained authentication tools? The whole point here is that we are looking at specific identity attributes to determine access or those involved in an orchestration flow, where both data and policies are subject to change at a moment’s notice. Being able to look up and evaluate that data with the same tool seems to make the most sense to me.


To me, the biggest value here is more efficient access to data and understanding how said data will be used. In an age where we are increasingly concerned with governance, compliance, and regulation, maybe this is the way we need to think about identity data and how it is represented for use in identity-related operations.





1 My opinions remain my own, and nothing said here represents any official positions or statements from Ping Identity or any organization I might be associated with unless otherwise specified.

Friday, February 16, 2024

Regarding the recent SAP IDM Announcement

 “Life begins like a dream, becomes a little real, and ends like a dream.” ― Michael Bassey Johnson, The Oneironaut’s Diary

As many of you already know, SAP has made public its plans on how SAP IDM will be retired as a supported offering. I’ve been stewing on this for a bit as I try to figure out exactly how I feel about this and what needs to happen next.

To be fair, I haven’t worked with the product much for just over four years, and even then, I was working more with Version 7 than with Version 8. My opinions are completely my own and do not represent my current employer, any previous employer, or SAP.

While IDM is certainly showing its age, there are some very good things about it that I would love to see as an open-source offering. First is the Batch Processing capabilities of IDM, based on the old MaXware Data Synchronization Engine/MetaCenter solutions. It features some powerful functionality to synchronize and cleanse data. It sets up fairly easily and is quite easy to configure. I’m sure the open-source community could do well with maintaining the UI (It definitely should be JAVA-based rather than the old Windows MMC) that will fit better in today’s Enterprise setting. Also, easy integration with SaaS services is a needed upgrade.

The other thing that should be released into the wild is the Virtual Directory. It also provides powerful functionality for several use cases, from pass-through authentication to assisting in M&A use cases. It’s the perfect example of a “Black Box” offering that just works. It also makes it much easier to synchronize and cleanse data by representing many different back ends via the easy-to-consume LDAP standard.

It saddens me that SAP is choosing to move away from IDM, as one of the key selling points of SAP IDM is its ability to integrate seamlessly with the SAP ecosystem. I hope SAP will help all LCM/IGA vendors connect more easily with systems. SaaS integration should be easy or standards-based, but we still need to be concerned for organizations still using on-premises SAP tools.

SAP has indicated that Microsoft’s Entra ID will be the main partner in the future, but I hope they make this information open to all vendors and that there will be continuing support of standard protocols. This article gives me some hope, but actions speak louder than words. I do have some concerns that SAP, known as a vast software ecosystem that supports itself and tends to ignore the enterprise, is handing off to another large software provider whose management tools tend to support their software ecosystem first and consider the enterprise second. Let’s face it: most of Microsoft’s Identity and Access Management efforts have been about supporting the Office 365 family of products. Don’t get me wrong; it’s better than SAP in this regard, but it’s not that high of a level to meet. For what it’s worth, I am guardedly optimistic, but I always try to remain hopeful.

Finally, I think it’s important to thank the IDM team in Sofia for all their hard work over the years, which, of course, would not have been possible without the vision and effort of the original MaXware team based in Trondheim, Norway, and associated teams in the UK, Australia, and the US. The production from these small teams helped define what Identity Management is to this day.

Will this be my last blog entry on the topic of SAP IDM? I don’t know. Part of it will depend on if there are any moves towards the Open Source world. There have been at least three times in my life when I thought I was done with this tool, and deep down, I’m pretty sure there is a little more in my future. 

In the meantime, I hope to resume blogging more regarding the Identity and Access Management field in the near future. Time will tell.



Tuesday, October 08, 2019

Endings, Beginnings, and Certification!

Hi folks, so it's been a while. 

That's mostly since I was blogging over on the wonderful SAP Community. Unfortunately, I will not be as active there now as my career is moving away from the wide, wonderful world of SAP as I have taken on a new position as a Regional Solutions Architect at Ping Identity.

This affords me the ability to explore new areas of the Identity Management landscape, and play with some technologies that I've always been very interested in but have not had the time to delve into. I'm hoping as I learn and experience more that I will get to share it with you folks.

Which leads me to the third item in this entry's title, certification. I guess they knew I was coming and how interested I am in getting certified in technologies as Ping has just announced a certification program!

If you use Ping products in your business, or do Ping related services work, this is something you should definitely look into, and look for.

Here's to the next stage of the career and certification journey!

#pingidentity #training #security #cybersecurity #certification

Monday, February 01, 2016

You've read my ramblings, now listen to them!

You've been reading my ramblings for years here and on SCN. Now you have a chance to listen to some of my thoughts on SAP IDM and a bit on SAP IDM 8 I was recently interviewed by long time colleague and fellow IDM Expert,Scott Eastin for his IDM Masters Interview Series

Please take a moment to listen to the interview and support Scott's efforts!

BTW, please let me know if this is interesting and if we should consider a regular podcast / YouTube discussion of SAP IDM, along with topics that you would like to see covered!

Thanks!

Saturday, September 12, 2015

SAP TechEd 2015

Just a quick not to let everyone know that I will be speaking at SAP TechEd 2015! I will be speaking on the new version of SAP IDM:


How Will YOU Prepare for SAP Identity Management 8

This session will be on Thursday, October 22 from 11:45 - 12:45. Without giving it all away, I'm planning on talking about how this new version of SAP IDM will affect the various members of your organization as you plan and implement this exciting new version of SAP IDM.

This should be a fun and interactive presentation where we will have a chance to discuss how your organization will prepare for IDM 8.

As this link will be shared on Social Media, let me take a moment and introduce myself for people who are unfamiliar with me and with IDM in general.

My name is Matt Pollicove and I have been working with SAP Identity Management for the past 11 years, from its beginnings as the MaXware Identity Center, which was purchased by SAP in 2007 to become IDM.

Over the years I have done engineering, training, project management, architecture, blogging, and yes, speaking on SAP IDM. 

SAP IDM is the preferred system for managing user accounts (identities) in the SAP Landscape and the Enterprise as a whole.  It offers  a wide array of connectors and a dynamic framework for creating, maintaining, and deprovisioning accounts.  The new generation of this product, IDM 8, embraces new technologies and offers new approaches to Identity Management.

Sunday, March 23, 2014

Measuring Identity Management

When I first started in the IT/Services field, I worked on a help desk providing technical support for a software company. Everything on the job was about Metrics: How many calls did you take, how long you were on the call.  Later, I managed the support group and the metrics got more interesting: Who called the most? What did people call about the most? This information needed to be shared amongst my fellow team leaders, my immediate management, sales management, product management, and even the executive management of the company. As a primary interface between the company and its clients, I had a lot of information.

I see Identity Management as holding a lot of that same type of information that would be of interest to various parts of the organization. Understanding who is provisioned to what endpoint, how identities change in the organization over time, users with given access rights. How many people are set up with the new password management scheme? Have processed their attestations? The list is ever changing and of course would vary by organization, per Pollicove's Law.

Sure, we can generate reports that show this information, but I think there could be a use for a dashboard views showing real/near real-time views of essential data.  Reports are all well and good, particularly when trying to analyze data over a period of time.


What metrics do you think would be of the most value in an Identity Management Solution?

Thursday, December 12, 2013

What comes after IDM?

People often ask me what comes after Identity Management? My answer is that it depends.

As I've discussed before, it's really up to what the organization requires and simply tacking on new workflows, approvals, and functionality is only really useful if it will actually be used.  However, I think we can make a few generalizations about what might occur as part of a far reaching and comprehensive IdM program.

Assuming that the initial project succeeded in its goal of creating an authoritative data store and basic provisioning, there's always the goal of adding more applications and additional attributes in existing applications that can be provisioned as part of workflow.

Password management is always popular.  If your application allows password provisioning or linking into a SSO or password management solution, this is a great place to add in further automation.  Your organization's help desk will appreciate it, I'm sure.

Adding in a compliance solution (sometimes referred to a certification or attestation) is always something organizations look into as a part of that overall IdM program. Some applications such as SailPoint IIQ have this built in, while others such as SAP GRC or Oracle Identity Governance are separate, but complementary modules to the Identity Management offering.

However what I think is one of the key places that the IdM program manager should be looking at is automation of IT processes. Every day the Help Desk and the System/Network administrators are using untrackable and un-auditable tools for editing user accounts. IT Management and Audit staff have no idea exactly what these people are doing as they are on the job.  At the very least, there is the possibility that users will be accidentally granted the wrong entitlements, and in the worst case, there could be the creation of undocumented SuperUsers. If we can direct these actions through the user provisioning application, then we can have an audit trail that tells us:

  • Who was worked with
  • What was done to them
  • Who did the work
  • When the work happened

It also becomes a lot easier to do these tasks when they are placed in the IdM solution.  This lets our Server Admin and Help Desk teams work on the more detailed analysis and troubleshooting that they were hired for rather than mundane user management, all while creating a more secure and audited environment.