Regarding the recent SAP IDM Announcement

 “Life begins like a dream, becomes a little real, and ends like a dream.” ― Michael Bassey Johnson, The Oneironaut’s Diary

As many of you already know, SAP has made public its plans on how SAP IDM will be retired as a supported offering. I’ve been stewing on this for a bit as I try to figure out exactly how I feel about this and what needs to happen next.

To be fair, I haven’t worked with the product much for just over four years, and even then, I was working more with Version 7 than with Version 8. My opinions are completely my own and do not represent my current employer, any previous employer, or SAP.

While IDM is certainly showing its age, there are some very good things about it that I would love to see as an open-source offering. First is the Batch Processing capabilities of IDM, based on the old MaXware Data Synchronization Engine/MetaCenter solutions. It features some powerful functionality to synchronize and cleanse data. It sets up fairly easily and is quite easy to configure. I’m sure the open-source community could do well with maintaining the UI (It definitely should be JAVA-based rather than the old Windows MMC) that will fit better in today’s Enterprise setting. Also, easy integration with SaaS services is a needed upgrade.

The other thing that should be released into the wild is the Virtual Directory. It also provides powerful functionality for several use cases, from pass-through authentication to assisting in M&A use cases. It’s the perfect example of a “Black Box” offering that just works. It also makes it much easier to synchronize and cleanse data by representing many different back ends via the easy-to-consume LDAP standard.

It saddens me that SAP is choosing to move away from IDM, as one of the key selling points of SAP IDM is its ability to integrate seamlessly with the SAP ecosystem. I hope SAP will help all LCM/IGA vendors connect more easily with systems. SaaS integration should be easy or standards-based, but we still need to be concerned for organizations still using on-premises SAP tools.

SAP has indicated that Microsoft’s Entra ID will be the main partner in the future, but I hope they make this information open to all vendors and that there will be continuing support of standard protocols. This article gives me some hope, but actions speak louder than words. I do have some concerns that SAP, known as a vast software ecosystem that supports itself and tends to ignore the enterprise, is handing off to another large software provider whose management tools tend to support their software ecosystem first and consider the enterprise second. Let’s face it: most of Microsoft’s Identity and Access Management efforts have been about supporting the Office 365 family of products. Don’t get me wrong; it’s better than SAP in this regard, but it’s not that high of a level to meet. For what it’s worth, I am guardedly optimistic, but I always try to remain hopeful.

Finally, I think it’s important to thank the IDM team in Sofia for all their hard work over the years, which, of course, would not have been possible without the vision and effort of the original MaXware team based in Trondheim, Norway, and associated teams in the UK, Australia, and the US. The production from these small teams helped define what Identity Management is to this day.

Will this be my last blog entry on the topic of SAP IDM? I don’t know. Part of it will depend on if there are any moves towards the Open Source world. There have been at least three times in my life when I thought I was done with this tool, and deep down, I’m pretty sure there is a little more in my future. 

In the meantime, I hope to resume blogging more regarding the Identity and Access Management field in the near future. Time will tell.

You've read my ramblings, now listen to them!

You've been reading my ramblings for years here and on SCN. Now you have a chance to listen to some of my thoughts on SAP IDM and a bit on SAP IDM 8 I was recently interviewed by long time colleague and fellow IDM Expert,Scott Eastin for his IDM Masters Interview Series. 

Please take a moment to listen to the interview and support Scott's efforts!

BTW, please let me know if this is interesting and if we should consider a regular podcast / YouTube discussion of SAP IDM, along with topics that you would like to see covered!

Thanks!

Another Blogger comes up to Bat

I was quite happy to discover a new person blogging on SAP's NetWeaver Identity Management. Ian Daniel, of Adventures in SAP IdM. Of course in Ian's case it's a Cricket Bat as he works and lives in the United Kingdom.

Ian seems to be the first of a new breed of IdM consultants making the change from traditional SAP consulting to Identity Management.  From reading the first few posts, it seems clear that he has both theoretical and field experience, which is always a welcome combination. I'm looking forward to seeing what he has to say in the coming months, and I think you will too.

Look for posts on his blog and on SAP SDN.

Welcome to the team, Ian!

Identity up in the Cloud

This was a topic that I thought I would really be getting into during 2010, but somehow the Cloud never really seemed to become the story.  On the whole, I think there were more discussions regarding the definition of Identity and the Federation of those identities between systems.  However there's still be some discussion of what the "cloud" actually is and how it should function in various disciplines, including Identity Management.

I thought that David Kearns recent article on Avoiding "cloud anguish" had an interesting point that I would also like to comment on.

"...the “year of” any technology isn’t recognized until long after it has passed. 2010 may well be labeled as the Year of the Cloud, but that won’t be for some time to come and I’m beginning to doubt that it will."

So my interpretation is that moving to the Cloud is going to be something that we realized has happened, not something that is happening. Yeah, this is going to be a slow but fast process.  So what does this mean?  Well, to tell the truth almost everything on the Internet and in the enterprise is essentially a cloud process, particularly when we consider the concept of the "private cloud"  Connections to Email/SharePoint/Document Management/Identity Management/Access Management all happen this way.  We interact with a client (usually web-based these days) and then authenticate  in using VPN or the corporate network.

What's going to make this something that has happened?  Well I think when we start making it easier to connect various private clouds through some sort of Identity Federation and the process starts moving towards something we touch each and every day. We see the beginnings of this now with social networks that allow us to communicate with different Internet sites and applications.

Dave also talks about one of my biggest concerns with Cloud computing, and that's security. I've always had some concerns when things I am responsible for are parceled out to people that have no real stake in the project/organization/what have you to begin with.  Don't get me wrong, these people have a professional responsibility to maintain security, but it's just another data silo to them, not sales contacts, customer lists, identity data that are your organization's life-blood. To me there's always been a slight difference between data owners (the organization that owns the data) and data custodians (those who take care of the data in the cloud)  All in all, I like to keep it all close to me where I can keep an eye on it.

Of course this means that as the data owner, if I'm not putting my data in the hands of the "professionals" it's my responsibility to keep it all safe and secure, which means I need to make sure I have backups, redundant data centers, high availability, and secure communications to keep everything protected.  Sounds like a cloud to me.

The whole point of this is that we don't really know where the cloud begins and where it ends.  When we figure out what or where that is, then the cloud will be here to stay, until then it's anyone's guess.

The meaning of Identity?

I’ve been involved in a number of conversations lately with colleagues and the Identity Commons mailing list about the nature of identity. The fact of the matter is that as far as the Information Technology / Information Security arena is concerned, there truly is no such concept as an identity. Rather what we truly have is a collection of descriptors or “attributes” that when brought together and agreed upon by an organization or group of organizations that describes what we choose to call the identity. Why the vagueness here? Well that’s because an identity can be more than just people, but that’s another story. Regardless, once we have determined what goes into an identity, we can begin to discuss how technology can process it.

The thing that I’m hearing more and more is that just having an identity is not enough. As mentioned previously, the identity is just an agreed on set of descriptors and does not really do anything. So how do we make this happen?

Well it is rather easy when everything is within the same domain. Agreements are easy (well, easier) to make when there is only one organization involved. Once we get outside of the domain, there greater complexity due to meeting the diverse needs of each organization, including (but not limited to) audit requirements, privacy rules, establishing common protocols and, of course, determining a description of what the identity is in the first place.

It’s great that we’re linking in tightly to ERP suites as Oracle and SAP tell us we should do. Leveraging repositories for use in authentication is great as Microsoft says we should do. Federation would be fantastic if we could get folks to come to quick agreements. What we really need is more actions that are associated with what we do with these identities. From what I’m seeing / hearing, there’s not enough being done with the actual identities once we’ve constructed them based on the authoritative sources in the organization’s IT infrastructure.

I think a great example of what can be done is shown in an article in CIO magazine that I saw on Jackson Shaw’s blog the other day.

We talk about these things all the time, but it seems many organizations barely get out of the Authentication / ERP stage since that’s perceived to have more direct impact.
I disagree. Truly actionable items that result in a direct decrease in getting employees functional should be the first effort in any Identity Management project after the data has been cleaned and a definition of what an identity is.

This is an ongoing discussion that’s not going away anytime soon. Not the definition of Identity, not what to do with the Identity, or how to protect the Identity.

New Blogroll Entry

Just started following a blog run by some old friends of mine. A link to their blog now appears in my blogroll.

I had the good fortune to work with Adrian Rodriguez and Ramanth Krishnamurthi at various projects while at Mycroft. They have some interesting thoughts on Access Management, Identity Management and the Managed Services spaces. This is their corporate blog and I think we'll be seeing some interesting things from them in the weeks and months to come.

I foresee many interesting conversations on these topics in the future.

Project Listening

At the end of my last post I made a reference to pay attention to the customer's needs when planning and executing an Identity Management project:

...Whether you are a consultant helping a client with their solution or an internal employee building your firm's Identity Management strategy, you still have a client, and their needs should always come first...

I recently took part in a Linkedin discussion where the person posting the question asked the question:

...I would be interested in your take on the latest and greatest products to implement for Identity and Access Management needs across the enterprise. Thoughts / comments...

I gave a pretty straightforward answer which covered some informative (in my opinion) basics centering on looking at the basic systems in the enterprise and advised the questioner to move forward from there.

There were a lot of people who went on another tangent, which was a more consultative answer... Find out what you need and then go to match technology.

Sounds like we have a chicken and the egg here.We cannot determine what technology fits until we determine how the technology is to be used. We also cannot determine how to use the technology unless we know what the technology can do.

Who is right? Who is wrong? I don't think either viewpoint is wrong. The fact is the first questions should have been along the lines of:

• Have you determined use cases?
• Have you begun to look at what technologies are out there?
• Who is using the system?

Nothing about management, systems, or anything else. The initial basic tasks must be this broad outline. Once these big questions are answered we can do to then fill in the holes and determine how to answer all the little questions.

Incidentally, my answer came from the fact that the questioner specifically wanted to know about technology. Since the initial posting he has not made any comments on which approach he needed, but I did see that my good friend and fellow blogger, Matt Flynn posted as well!

Thank you, Mr. Flynn!

I'd like to take a moment to thank my former colleague and Identity Management discussion partner, Matt Flynn for a great reference on his blog. Matt and I worked (and sat in adjoining cubes) at MaXware. I've enjoyed reading his blog and find that he always has something interesting to say. Please take a moment and visit his blog, trust me, it's worth it!