On October 17th, I posted a short blog and a
podcast interview with Chirag Andani,
talking about how Oracle IT uses its own
IDM products. Blog link here.
In response, I
received a comment from reader Jaime Cardoso (
[email protected])
who posted:
“- You could have
talked about how by deploying Oracle's Open standards base technology you were
able to integrate any new system in your infrastructure in days.
- You could have
talked about how by deploying federation you were enabling
the business side to
keep all their options open in terms of companies to buy and sell while
maintaining perfect employee and customer's single view.
- You could have
talked about how you are now able to cut response times to your audit and
security teams into 1/10th of your former times
Instead you spent 6
minutes
talking about single sign on and self provisioning? If I didn't knew
your IDM offer so well I would now be wondering what its differences from
Microsoft's offer was.
Sorry for not giving a
positive comment here but, please your IDM suite is very good and, you simply
aren't promoting it well enough”
So I decided to send Jaime a note asking him about his
experience, and to get his perspective on what makes
the Oracle products
great. What I found out is that Jaime is
a very experienced IDM Architect with several major projects under his belt.
Darin Pendergraft:
Can you tell me a bit about your experience? How long have you worked in IT, and what is your IDM experience?
Jaime Cardoso: I started
working in "serious" IT in 1998 when I became Netscape's technical
specialist in Portugal. Netscape Portugal didn't exist so, I was working for
their VAR here. Most of my work at
the time was with Netscape's mail server and
LDAP server.
Since that time I've
been bouncing between
the system's side like Sun resellers, Solaris stuff and
even worked with Sun's Engineering in
the making of an Hierarchical Storage
Product (Sun CIS if you know it) and
the application's side, mostly in LDAP and
IDM.
Over
the years I've
been doing support, service delivery and pre-sales / architecture design of IDM
solutions in most big customers in Portugal, to name a few projects:
-
The first European
deployment of Sun Access Manager (SAPO – Portugal Telecom)
-
The identity repository
of 5/5 of
the Biggest Portuguese banks
-
The Portuguese
government federation of services project
DP: OK, in your
blog response, you mentioned 3 topics:
1. Using Oracle's standards based architecture; (you) were
able to integrate any new system in days: can you give an example? What systems, how long did it take, number of
apps/users/accounts/roles etc.
JC: It's relatively easy
to design a user management strategy for a static environment, or if you simply
assume that you're an <insert vendor here> shop and all your systems will
bow to that vendor's will. We've all
seen that path,
the use of proprietary technologies in interoperability
solutions but, then reality kicks in. As
an ISP I recall that I made
the technical decision to use Active Directory as a
central authentication system for
the entire IT infrastructure. Clients,
systems, apps, everything was there.
As a good part of
the
systems and apps were running on UNIX, then a connector became needed in order
to have UNIX boxes to authenticate against AD. And, that strategy worked but,
each new machine required
the component to be installed, monitoring had to be
made for that component and each new app had to be independently certified.
A self care user
portal was an ongoing project, AD access assumes
the client is inside
the
domain, something
the ISP's customers (and UNIX boxes) weren't nor had any
intention of ever being.
When
the Windows 2008
rollout was done, Microsoft changed
the Active Directory interface.
The Windows
administrators didn't have enough know-how about directories and
the way
systems outside
the MS world behaved so, on
the go live, things weren't
properly tested and a general outage followed. Several hours and 1 roll back
later, everything was back working.
But,
the ISP still had
to change all of its applications to work with
the new access methods and reset
the effort spent on
the self service user portal. To keep with
the same
strategy, they would also have to trust Microsoft not to change interfaces
again.
Simply by putting up
an Oracle LDAP server in
the middle and replicating
the user info from
the AD
into LDAP, most of
the problems went away. Even systems for which no AD connector existed
had PAM in them so, integration was made at
the OS level, fully supported by
the OS supplier.
Sun Identity Manager
already had a self care portal, combined with a user workflow so, all
the clearances
had to be given before
the account was created or updated.
Adding a new system as
a client for these authentication services was simply a new checkbox in
the OS
installer and, even True64 systems were, for
the first time integrated also
with a 5 minute work of a junior system admin.
True, all
the windows
clients and MS apps still went to
the AD for their authentication needs so,
from
the start everybody knew that they weren't 100% free of migration pains
but, now they had a single point of problems to look at.
If you're looking for
numbers:
- 500K directory
entries (users)
- 2-300 systems
After
the initial
setup, I personally integrated about 20 systems / apps against LDAP in 1 day
while being watched by
the different IT teams.
The internal IT staff did
the
rest.
DP:
2. Using Federation allows
the business to keep options open for buying and
selling companies, and yet maintain a single view for both employee and
customer. What do you mean by this? Can you give an example?
JC:
The market is dynamic.
The
company that's being bought today tomorrow will be sold again. Companies that
spread on different markets may see
the regulator forcing a sale of part of a
company due to monopoly reasons and companies that are in multiple countries
have to comply with different legislations.
Our
job, as IT architects, while addressing
the customers and employees authentication
services, is quite hard and, quite contrary. On one hand, we need to give access to all of our employees to
the
relevant systems, apps and resources and, we already have marketing
talking
with us trying to find out who's a customer of
the bough company but not from
ours to address.
On
the other hand, we have to do that and keep in mind we may have to break up all
that effort and that different countries legislation may became a problem with
a full integration plan.
That's
a job for user Federation. you don't want to be
the one who's telling your
President that he will sell that business unit without it's customer's database
(making
the deal worth a lot less) or that
the buyer will take with him a copy
of your entire customer's database. Federation enables you to start controlling
permissions to users outside of your traditional authentication realm. So what
if
the people of that company you just bought are keeping their old logins? Do
you want, because of that, to have a dedicated system for their expenses
reports? And do you want to keep their sales (and pre-sales) people out of
the
loop in terms of your group's path?
Control
the information flow, establish a Federation trust circle and give access to
your apps to users that haven't (yet?) been brought into your internal login
systems. You can still see your users in a unified view, you obviously control
if a user has access to any particular application, either that user is in your
local database or stored in a directory on
the other side of
the world.
DP:
3. Cut response times of audit and security teams to 1/10. Is this a real number? Can you give an example?
JC: No, I don't have any backing for
this number.
One
of
the companies I did system Administration for has a SOX compliance policy in
place (I remind you that I live in Portugal so, this definition of SOX may be
somewhat different from what you're used
to)
and, every time
the audit team says they'll do another audit, we have to negotiate
with them
the size of
the sample and we spend about 15 man/days gathering all
the required info they ask.
I
did some work with Sun's Identity auditor and, from what I've been seeing,
Oracle's product is even better and, I've seen that most of
the information
they ask would have been provided in a few hours with
the help of this tool. I do stand by what I said here but, to be
honest, someone from Identity Auditor team would do a much better job than me
explaining this time savings.
Jaime is right:
the Oracle IDM products have a lot of
business value, and Oracle IT is using them for a lot more than I was able to
cover in
the short podcast that I posted.
I want to thank Jaime for his comments and perspective. We want these blog posts to be informative
and honest – so if you have feedback for
the Oracle IDM team on any topic
discussed here, please post your comments below.
