Regarding the recent SAP IDM Announcement

 “Life begins like a dream, becomes a little real, and ends like a dream.” ― Michael Bassey Johnson, The Oneironaut’s Diary

As many of you already know, SAP has made public its plans on how SAP IDM will be retired as a supported offering. I’ve been stewing on this for a bit as I try to figure out exactly how I feel about this and what needs to happen next.

To be fair, I haven’t worked with the product much for just over four years, and even then, I was working more with Version 7 than with Version 8. My opinions are completely my own and do not represent my current employer, any previous employer, or SAP.

While IDM is certainly showing its age, there are some very good things about it that I would love to see as an open-source offering. First is the Batch Processing capabilities of IDM, based on the old MaXware Data Synchronization Engine/MetaCenter solutions. It features some powerful functionality to synchronize and cleanse data. It sets up fairly easily and is quite easy to configure. I’m sure the open-source community could do well with maintaining the UI (It definitely should be JAVA-based rather than the old Windows MMC) that will fit better in today’s Enterprise setting. Also, easy integration with SaaS services is a needed upgrade.

The other thing that should be released into the wild is the Virtual Directory. It also provides powerful functionality for several use cases, from pass-through authentication to assisting in M&A use cases. It’s the perfect example of a “Black Box” offering that just works. It also makes it much easier to synchronize and cleanse data by representing many different back ends via the easy-to-consume LDAP standard.

It saddens me that SAP is choosing to move away from IDM, as one of the key selling points of SAP IDM is its ability to integrate seamlessly with the SAP ecosystem. I hope SAP will help all LCM/IGA vendors connect more easily with systems. SaaS integration should be easy or standards-based, but we still need to be concerned for organizations still using on-premises SAP tools.

SAP has indicated that Microsoft’s Entra ID will be the main partner in the future, but I hope they make this information open to all vendors and that there will be continuing support of standard protocols. This article gives me some hope, but actions speak louder than words. I do have some concerns that SAP, known as a vast software ecosystem that supports itself and tends to ignore the enterprise, is handing off to another large software provider whose management tools tend to support their software ecosystem first and consider the enterprise second. Let’s face it: most of Microsoft’s Identity and Access Management efforts have been about supporting the Office 365 family of products. Don’t get me wrong; it’s better than SAP in this regard, but it’s not that high of a level to meet. For what it’s worth, I am guardedly optimistic, but I always try to remain hopeful.

Finally, I think it’s important to thank the IDM team in Sofia for all their hard work over the years, which, of course, would not have been possible without the vision and effort of the original MaXware team based in Trondheim, Norway, and associated teams in the UK, Australia, and the US. The production from these small teams helped define what Identity Management is to this day.

Will this be my last blog entry on the topic of SAP IDM? I don’t know. Part of it will depend on if there are any moves towards the Open Source world. There have been at least three times in my life when I thought I was done with this tool, and deep down, I’m pretty sure there is a little more in my future. 

In the meantime, I hope to resume blogging more regarding the Identity and Access Management field in the near future. Time will tell.

Identity up in the Cloud

This was a topic that I thought I would really be getting into during 2010, but somehow the Cloud never really seemed to become the story.  On the whole, I think there were more discussions regarding the definition of Identity and the Federation of those identities between systems.  However there's still be some discussion of what the "cloud" actually is and how it should function in various disciplines, including Identity Management.

I thought that David Kearns recent article on Avoiding "cloud anguish" had an interesting point that I would also like to comment on.

"...the “year of” any technology isn’t recognized until long after it has passed. 2010 may well be labeled as the Year of the Cloud, but that won’t be for some time to come and I’m beginning to doubt that it will."

So my interpretation is that moving to the Cloud is going to be something that we realized has happened, not something that is happening. Yeah, this is going to be a slow but fast process.  So what does this mean?  Well, to tell the truth almost everything on the Internet and in the enterprise is essentially a cloud process, particularly when we consider the concept of the "private cloud"  Connections to Email/SharePoint/Document Management/Identity Management/Access Management all happen this way.  We interact with a client (usually web-based these days) and then authenticate  in using VPN or the corporate network.

What's going to make this something that has happened?  Well I think when we start making it easier to connect various private clouds through some sort of Identity Federation and the process starts moving towards something we touch each and every day. We see the beginnings of this now with social networks that allow us to communicate with different Internet sites and applications.

Dave also talks about one of my biggest concerns with Cloud computing, and that's security. I've always had some concerns when things I am responsible for are parceled out to people that have no real stake in the project/organization/what have you to begin with.  Don't get me wrong, these people have a professional responsibility to maintain security, but it's just another data silo to them, not sales contacts, customer lists, identity data that are your organization's life-blood. To me there's always been a slight difference between data owners (the organization that owns the data) and data custodians (those who take care of the data in the cloud)  All in all, I like to keep it all close to me where I can keep an eye on it.

Of course this means that as the data owner, if I'm not putting my data in the hands of the "professionals" it's my responsibility to keep it all safe and secure, which means I need to make sure I have backups, redundant data centers, high availability, and secure communications to keep everything protected.  Sounds like a cloud to me.

The whole point of this is that we don't really know where the cloud begins and where it ends.  When we figure out what or where that is, then the cloud will be here to stay, until then it's anyone's guess.

2010 and the Year in Identity

As the year draws down, I've been thinking a bit about the year and what's it's meant in Identity Management. There's certainly been a bit of discussion about the nature of Identity, authentication and authorization controls.  As technology, process and legislation grow closer, there's a greater need for Governance and Compliance controls than ever before.  We're also seeing the beginning of the Cloud truly being a part of the IdM solution.

We're also seeing consolidation on the business side in both the product and implementation branches with Oracle, SAP and Microsoft all making purchases.

Related to this, one thing I've been wondering is what will happen with SAP systems if you rely on either CUA or SUN Identity Manager. What are your plans, if any, for migrating off?  I've started a discussion on LinkedIn about this. Please take a moment and  share your thoughts about what you are considering or planning.

On a personal note, I wish all of my readers a happy and healthy New Year.

SaaS-ish IdM

Matt F had some interesting things to say regarding my thoughts on why SaaS doesn't work for Identity Management.

I do agree with his point that most companies "are already outsourcing IdM – they just do it on a project basis" Let's face it, provisioning development is specialized work and it makes sense to let specialists do the work. To me this is the best argument in favor of combining IdM and SaaS.

However, looking back over the past couple of years with data breaches, Identity theft, etc, I still think that it makes more sense to keep everything under one's own lock and key.

Does this solve everything or protect the organization? Absolutely not, unscrupulous folks exist everywhere and keeping data local does not necessarily confer greater protection. However, if I were the person in charge of Compliance and Risk management, I'd want to be able to look at the auditors, police/FBI, Upper Management and lawyers after an incident and be able to say exactly what I did to protect my data and not say, "well the hosting company told me they were secure..." If the organization lacks the expereince of knowledge to properly secure thier infrastructure, bring it in, would be a wise investment.

Why not SaaS

To wrap up my thoughts on SaaS, I wanted to take a moment and discuss why I do not believe that SaaS is good for IdM and a little bit of how it could be made to do so.

I have a lot of trouble getting my head around the idea that I should (or ask some one to) trust an out side source with holding and processing my organization's identity data. Frankly, it scares the crap out of me. In this situation there would be terribly few controls over who accesses my servers and when. What happens when an upgrade goes in? How do I know what's going on? Basically, how do I guarantee the security of my implementation when it lives among people that "don't wear my company's shirt"?

Aside from this, I'm relying on a whole lot of infrastructure to make sure that my IdM applications stay up and running. What happens if there's a networking issue between my organization and the data center? How do I ensure scalability? What's the assurances on hardware availability?

These are the top two things that are on my mind when considering IdM and SaaS. Now I personally dislike it when someone comes to me with issues and does not have any ideas on how to remediate them. (I also think it's a downer) So here's some quick thoughts:

As far as security goes, one would have to assume that we can lock down the boxes and grant temporary access to the host/implementers for upgrade purposes. At a more basic level at some point there must be some level of TRUST between application owners and system administrators. If that trust is not there, then there's a more basic problem that needs to be addressed. I seem to recall a couple of years ago an article that discussed the need for trust between System Administrators and Application owners. I'll have to see if I can find the reference.

Hardware availability falls under the same umbrella. Great care needs to be taken when choosing a SaaS host that they have good failover and DR solutions. As far as scalability goes, I would suggest that if at all possible, test SaaS in a controlled pilot setting, possibly between the data center and the DR data center as a means to test availability, security and failover capabilities. Know that everything works in a way that fits the company's IdM mandate, GRC requirements and IT standards before looking for that SaaS provider.

SaaS: The Series

As you might know from reading the SECUDE Global Consulting Blog, I am at the Burton Catalyst Conference this week. One topic that I got into a lot during the first evening was about Software as a Service (Saas)

I heard a number of arguments, both Pro and Con about this topic. Over the next few days I plan on discussing a number of things about SaaS on this blog.

Rather than starting off with Pros and Cons of SaaS (those who know me, know my feelings, but I'll hold off for the moment) I'd like to start with what I call the Chicken and the Egg issue.

In some way shape or form, SaaS will come to IdM as it will to other areas of the IT world. However, I believe that IdM has some specific challenges that need to be addressed, namely in security and reliability.

Due to these considerations I'm thinking that only firms that specialize in the IdM space will be able to be successful hosts. However will firms be willing to be early adopters? This is where the Chicken and Egg argument comes in. Customers are going to want experienced hosts, but I do not believe there are any hosts out there that are ready.

I'll be discussing some of the details of what an experienced host will offer and some potential stratgegies for mitigating the risks in the coming days.